hi All, We have indexer cluster with 6 servers and out of these 4 servers has more than 90% space utilization. Due to storage limit we ahve been given 4 TB of space as addition. Will there be any impact if we add these 4 TB to onlt the 4 servers whihc has high space utilization but not the other two servers. If the Indexer cluster like below with disk size soecifications will there be any issues? Server1 - 2 TB Server2 - 2 TB Server3 - 2 TB Server4 - 2 TB Server5 - 1 TB Server6 - 1 TB Thanks, Sree ... View more

hi All, On one of our servers, we recently faced issues with file forwarding. Upon checking in internal logs, we saw the below events - 27/09/2018 10:34:49.688 09-27-2018 10:34:49.688 +0200 INFO ulimit - Limit: open files: 4096 files host = ABCDSERVER01  source = /app/splunkforwarder/var/log/splunk/splunkd.log  sourcetype = splunkd But upon checking on the server for Splunk UF with the user, it's running the ulimit value shown as below - open files (-n) 100000 Not sure why there is a difference or am i missing something here? Thanks, Sree ... View more

hi All, Recently we have seens bucket corruption issues in our cluster. Upon chekcing with support they concluded that the root cause might be disk latency issues. Is it possible to monitor the Disk Health parameters of indexer servers in Splunk ? Thanks, Sree ... View more

hi All, We are on Splunk v7.0.4. Will Internal Change management for Splunk configs App work on Splunk v7.0.4? Thanks, Sree ... View more

hi team, If i have created scheduled searches/jobs on one of our standalone Search Heads (Search Head "A") and after a couple of months if we add two more search heads ( "B" and "C" ) and made it a cluster. How do the scheduled searches work in a cluster? Since Searches have been initially created on Search Head "A" , will they always run on Search Head "A"? If it's yes for the above question, then in case at the scheduled time due to various reasons ( like if SH A goes down ), will they run on SH B or SH C? OR Captain of the Search Head Cluster decide where to run the scheduled searches in the cluster? If we have 5 Scheduled jobs or searches do we need to manually create them 2 on each Search Head to disperse the load? How do they work? Please help me. Thanks, SM ... View more

hi All, We would like to check if DB connect app is compatible with MS SQL 2016 ? https://splunkbase.splunk.com/app/2686/#/details http://docs.splunk.com/Documentation/DBX/3.1.3/ReleaseNotes/Releasenotes#Known_issues Thanks, Sree ... View more

hi Team, During any maintenance releases of WebSite , is it possible to have monitoring alerts blackout functionality in splunk so we don't receive any notable events/alerts in ITSI or Splunk. Or is it possible to enable the blackout of a specific services in ITSI for not generating notable events. Thanks, Sreedhar ... View more

hi All, Is it possible to containerize Splunk in Azure Cloud for ON-Premise environment like backend servers , Master, SH's , Indexers, Deployment server, Depoloyers, HF's . If supported, would it provide any benefit or only added complexity? Thanks, Sree ... View more

hi Team, We are using FMC v6.* version. To integrate the logs of FirePower managemnet console can someone guide me how to setup the Firepower eNcore App for Splunk. We have Splunk ES on Dedicated standalone SH and also we have one HF where we are DB Connect App for pulling sec data. Do we need to install the Addon on HF to pull the data? there is no clear installation document for the same. Can someone help me with the installation steps. Thanks, Sree ... View more

Hi All, We have nearly 500 UF's in our environment on Linux hosts. We are planning to upgrade our environment. Can someone help me if anyone has automated the process of upgrading UF on Linux hosts before? Thanks, Sree ... View more

hi All, We ahve installed Splunk UF windows v6.6.3 as well as v7.0.4 but on one of the servers everytime inside /splunkforwarder we can see only two folders /etc and /var , other folders are missing including /bin. Has anyone else faced this issue? Thanks, Sree ... View more

hi All, We have indexer cluster with 10 Idx. Is it possible to run a search query for every 15 mins with a time range of last 15 mins as a schedule job at indexer level and the results of this job into an index =result_summary. If its possible can someone help me with the steps on how to achieve it? Thanks, Sree ... View more

hi Team, We have a requirement where we get results of more than 50000 when we run serach for last 24 hours. We need to set an alert in ITSI based on the count of result. Since by default the makeresults is 50000 we doont see all the results and triggering false notable events in ITSI. how does it impact if we increase the makeresults from default 50000 to 1 or 2 Million. [searchresults] maxresultrows = 50000 Thanks, Sree ... View more

hi All, In ITSI services we can see the total list of services we have. But we don't have any option to export the name. Is it possible to extract the list of ITSI services in a table through any rest search? Thanks, Sree ... View more

Hi All, Am planning to upgrade the app from v3.3.2 to v3.4.1. Unlike the v3.3.2 where it has been documented well for how to upgrade to v3.3.2 whihc is missing in v3.4.1? http://docs.splunk.com/Documentation/VMW/3.2.2/Installation/Upgrade Can someone help me if the process to upgrade to v3.4.1 is also same like v3.3.2 or anything has been changed? Thanks, sree ... View more

Hi All, Am looking to upgrade Splunk Core to v7.0 and we are using Dynatrace App v2.2.4 and planning to upgrade it to v2.4.0. But there is no documentation on how to upgrade Dynatrace App. Can someone help me with the steps of how to upgrade the Appmon/Dynatarce App? Thanks, Sree ... View more

hi All, When am trying to take kvstore backup in Security Search Head as part of upgrade process am getting below error. ./splunk backup kvstore [appuser@XYZSPKTEST01 bin]$ ./splunk backup kvstore Command error: 'backup' is not a valid command. Please run 'splunk help' to see the valid commands. For taking KVSTORE backup for ITSI we are using below command. /app/splunk/bin/splunk cmd python /app/splunk/etc/apps/SA-ITOA/bin/kvstore_to_json.py -s 8089 -u admin -p changeme -m 1 -f kvstore_bkp_5_11 -n  -b "2.6.1" Can someone help me how to take backup for Enterprise Security App. Thanks, Sree ... View more

hi All, I have 15 services with multiple KPI's in test environment which I need to move to another environment. using partial backup can I move all of these 15 services to the desired environment. in the documentation it has been given for one service, will it work for multiple services as well? If so can someone help me how to do that Example of my Services: ABCD Hybris shgjh ABCD Hybris hsjlkk ABCD Hybris bjksjk XYZ Hybris yyriyi XYZ Hybris wterety XYZ Hybris poiopi Hybris is the only common in the services, will it work if i use like below [ { "object_type": "service", "title_list": "^* Hybris *$" } ] OR [ { "object_type": "service", "title_list": "^ ABCD Hybris shgjh$" , "^ ABCD Hybris hsjlkk$", "^ ABCD Hybris yyriyi$" } ] http://docs.splunk.com/Documentation/ITSI/3.0.0/Configure/kvstore_to_json.pyoperations#Partial_backup Thanks, Sree ... View more

Hi all, VNX Addon is working fine for most of the sourcetypes except for the SPS hardware failure. We are using Splunk v6.6.3 . Any idea why we are not receiving events for SPS failures? Also, we are planning to upgrade the Enterprise to v7.1 does it supports v7.*? Thanks, Sree ... View more