Hello, I've got a clustered indexers (2 sites) running 6.3 since today, the following kind of message appears in the console : Search peer <search peer> has the following message: Too many streaming errors to target=<target peer>. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs.) I've followed this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Bucketreplicationissues by searching for the CMStreaming errors in _internal logs. It looks like there was some network issue during the night (and may be at two other times, so the max number of errors is achieved) Right now, it seems fixed (I can connect on the splunk replication port from a indexer to another) and the cluster say my replication factor is fine. So I wan't to reset the counter to zero (not change the max value) I've tried putting the cluster in maintenance mode and do a rolling restart That doesn't seem effective. Any idea how do I reset this ? thanks ... View more

Hello, my Splunk instance is running on standard port 8000 with user splunk.(on Linux) web ssl activated port 8000 is unreachable from users (blocked by firewall) port 443 is open As such, I can't modify splunk web to run on port 443 I've added a iptables redirect from port 443 to 8000 (ie nat) this is working well but I need to tell Splunk that it is only reachable on port 443 and not 8000 I've tried unsucessfully : - set tools.proxy.base (in web.conf) to https:://myserver/ - idem + tools.proxy.on = True - tools.proxy.base = https://myserver:443/ + tools.proxy.on = True However, I can still see urls with :8000 in it (like when restarting Splunk service from splunk web interface) Any idea what is the good settings to teach Splunk web how to reach the web interface including protocol scheme + hostname + port ? ... View more

Hello, I'm doing such a search: mysearch | stats dc(ip) as countip, values(ip) as valuesip | where countip > xxx | table countip,valuesip Then either export results via the UI or scheduling and sending the csv results. The number of returned rows is a few lines (<100) countip max is about 6000 so the valuesip field may contain a list of 6000 ips In the Splunk Web UI, it looks correct. In the csv file, when I look at it in a text editor, I see the line breaks at 991 characters. Results are not truncated, but they are on the second line and so on. Obviously, when opening the csv file, it produces garbage ... So I need to change the "max line length before adding a new line character when exporting by csv" parameter? I couldn't find which setting it is. Any idea? ... View more