Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shivanandbm
shivanandbm
Explorer
Member since:
04-29-2018
08-19-2022
Community Statistics
| Posts | 51 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-29-2018 |
Activity Feed
- Got Karma for Re: is it possible to upgrading to lower versions during roll back? if not possible kindly help me for step by step procedure for rollback.. 08-30-2023 12:37 PM
- Posted How to configure heavy forwarders as intermediate forwarders? on Installation. 08-19-2022 05:51 AM
- Posted how to install the parsing file in the indexer cluster? on Deployment Architecture. 03-31-2020 07:53 AM
- Tagged how to install the parsing file in the indexer cluster? on Deployment Architecture. 03-31-2020 07:53 AM
- Posted apparent dedup which sometimes occurs in summary index on Knowledge Management. 03-12-2020 01:28 AM
- Tagged apparent dedup which sometimes occurs in summary index on Knowledge Management. 03-12-2020 01:28 AM
- Tagged apparent dedup which sometimes occurs in summary index on Knowledge Management. 03-12-2020 01:28 AM
- Posted Re: Duplicates events in search on Splunk Search. 03-04-2020 03:07 AM
- Posted Re: Duplicates events in search on Splunk Search. 03-04-2020 12:36 AM
- Posted Re: Duplicates events in search on Splunk Search. 03-04-2020 12:06 AM
- Posted Duplicates events in search on Splunk Search. 03-03-2020 11:22 PM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:39 PM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 10:32 PM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:48 AM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:47 AM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:30 AM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:21 AM
- Posted Re: scheduled reports with zero values on Reporting. 02-11-2020 11:17 AM
- Posted scheduled reports with zero values on Reporting. 02-11-2020 11:02 AM
- Posted Re: ArtifactReplicator - Connection failed on Deployment Architecture. 02-11-2020 08:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-19-2022
05:51 AM
I would like to have six intermediate forwarders before indexers.Also i am interested to configure prasing on intermediate forwarders only.can some help me how to configuration.
I have done the basic configuration where i am facing parsing quees and tail reader error on IF and traffic is getting blocked.
can you please help me solve this problem
... View more
Labels
- Labels:
-
heavy forwarder
-
universal forwarder
03-31-2020
07:53 AM
we have four indexer in cluster and master to mange .. i tride to push the parse file from the master but not able to see the fields after the push. can any one help me how to do push the parse file?
... View more
- Tags:
- splunk-enterprise
03-12-2020
01:28 AM
in rt index we have duplicates of the events but not finding same duplicates in summery indexes.Can some one tell me what might be the case?
... View more
Labels
- Labels:
-
summary indexing
03-04-2020
12:36 AM
How i can check whether the duplicates are happening from the cluster
... View more
03-03-2020
11:22 PM
Hi all,
I am finding duplicate events during search operation. I am bit confused on where the issue is lies and how to start investigating on this.
Regards,Shivanand
... View more
- Tags:
- splunk-enterprise
02-11-2020
11:39 PM
Below is the job inspector of zero values report. can you please check?
02-11-2020 10:48:02.191 INFO SearchOperator:loadjob - triggering artifact replication uri=https://127.0.0.1:8089/services/search/jobs/scheduler_c3ZjX3N1bW1hcmlzZXI_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXI__RMD506ccb4aefc833dac_at_1581417900_15508_638683B3-25D9-4D2A-AF2E-4E43362FDBFA/proxy?output_mode=json, uri_path=/services/search/jobs/scheduler_c3ZjX3N1bW1hcmlzZXI_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXI_RMD506ccb4aefc833dac_at_1581417900_15508_638683B3-25D9-4D2A-AF2E-4E43362FDBFA/proxy?output_mode=json
02-11-2020 10:53:02.257 INFO SearchOperator:loadjob - shc waited for artifact replication time_elapsed=300, success=0
02-11-2020 10:53:02.258 INFO SearchOperator:loadjob - Skip loading from non-existent file="/opt/splunk/var/run/splunk/dispatch/scheduler_c3ZjX3N1bW1hcmlzZXI_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXIRMD506ccb4aefc833dac_at_1581417900_15508_638683B3-25D9-4D2A-AF2E-4E43362FDBFA/results.srs.gz"
02-11-2020 10:53:02.258 INFO DispatchExecutor - END OPEN: Processor=inputlookup
02-11-2020 10:53:02.258 INFO DispatchExecutor - BEGIN OPEN: Processor=stats
02-11-2020 10:53:02.268 INFO SearchOperator:inputcsv - sid:scheduler_ZXhwb3N1cmVsYXllcl9yZXBvcnRpbmc_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXIRMD50a40cfc998311a8d_at_1581418080_15759_644D578C-F001-4711-B459-2338E22DF399 Successfully read lookup file '/opt/splunk/etc/apps/ee_search_exposurelayer/lookups/EL_domains_services.csv'.
02-11-2020 10:53:02.272 INFO DispatchExecutor - END OPEN: Processor=stats
02-11-2020 10:53:02.272 INFO DispatchExecutor - BEGIN OPEN: Processor=eventstats
02-11-2020 10:53:02.272 INFO DispatchExecutor - END OPEN: Processor=eventstats
02-11-2020 10:53:02.272 INFO DispatchExecutor - BEGIN OPEN: Processor=table
02-11-2020 10:53:02.273 INFO DispatchExecutor - END OPEN: Processor=table
02-11-2020 10:53:02.273 INFO DispatchExecutor - BEGIN OPEN: Processor=sort
02-11-2020 10:53:02.273 INFO DispatchExecutor - END OPEN: Processor=sort
02-11-2020 10:53:02.273 INFO DispatchExecutor - BEGIN OPEN: Processor=noop
02-11-2020 10:53:02.273 INFO DispatchExecutor - END OPEN: Processor=noop
02-11-2020 10:53:02.300 INFO SearchStatusEnforcer - Triggered listener notification on state onResults
02-11-2020 10:53:02.301 INFO ReducePhaseExecutor - Ending phase_1
02-11-2020 10:53:02.301 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.301 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='scheduler_ZXhwb3N1cmVsYXllcl9yZXBvcnRpbmc_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXI_RMD50a40cfc998311a8d_at_1581418080_15759_644D578C-F001-4711-B459-2338E22DF399', username='exposurelayer_reporting')
02-11-2020 10:53:02.301 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.303 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.304 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.304 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.304 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.304 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.304 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
02-11-2020 10:53:02.305 INFO UserManager - Unwound user context: exposurelayer_reporting -> NULL
... View more
02-11-2020
11:47 AM
this is not consistent and it happened almost 7 hours back and also we observed this issue yesterday as well..
... View more
02-11-2020
11:21 AM
this is a different problem started yesterday.Splunk version is 7.2.4
... View more
02-11-2020
11:17 AM
Indexer Problems:
https://answers.splunk.com/answers/798224/we-see-this-error-message-search-peer-usadc-xxxxx.html -- resolved by rebooting the servers
https://answers.splunk.com/answers/801804/artifactreplicator-connection-failed.html--this is not impacting the performance as these eerrors existing from last 6 months may be more.
above question is my actual problem
... View more
02-11-2020
11:02 AM
We have 3 search heads and they are in cluster.We are observing scheduled reports with zero values for few reports.zero value reports are generating from search head 3.Issue is not consistent.
we have one main search which will run in every 15 mins and 20 sub reports which use the main search via loadjob. these reports run every 15 mins ie 3 mins after the main search.so now few reports are delivered recepents with zero values from the search head 3.
i was seeing scheduler log usually runtime is 0.3 sec for a successful reports but for failed reports it run time showing 300sec.
Can anyone please help me to understand how i need to trouble shoot this?
... View more
- Tags:
- splunk-enterprise
02-11-2020
08:20 AM
als i see this error
02-11-2020 03:04:18.222 +0000 INFO SHCSlave - event=SHPSlave::handleReplicationError aid=scheduler_ZXhwb3N1cmVsYXllcl9yZXBvcnRpbmc_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXI__RMD521a333d1d9f1f391_at_1581390180_12973_644D578C-F001-4711-B459-2338E22DF399 src=644D578C-F001-4711-B459-2338E22DF399 tgt=638683B3-25D9-4D2A-AF2E-4E43362FDBFA failing=644D578C-F001-4711-B459-2338E22DF399 queued replication error j
... View more
02-11-2020
07:45 AM
Lookups are not too large...
... View more
02-11-2020
06:56 AM
i see similar errors in host 166..
ArtifactReplicator - Replication connection to ip=xx.xx.xxx.164:8999 timed out
02-11-2020 10:59:10.203 +0000 WARN ArtifactReplicator - Connection failed
02-11-2020 10:59:10.203 +0000 WARN ArtifactReplicator - event=artifactReplicationFailed type=ReplicationFiles files="/opt/splunk/var/run/splunk/dispatch/splunktemps/send/s2s/scheduler_c3ZjX3N1bW1hcmlzZXI_ZWVfc2VhcmNoX2V4cG9zdXJlbGF5ZXI_RMD586fb6099b3dba69f_at_1581418680_15799_644D578C-F001-4711-B459-2338E22DF399-638683B3-25D9-4D2A-AF2E-4E43362FDBFA.tar" guid=638683B3-25D9-4D2A-AF2E-4E43362FDBFA host=xx.xx.xxx.164 s2sport=8999 aid=928179. Connection failed
... View more
02-11-2020
06:28 AM
yes ... all cluster mambers are up
... View more
02-11-2020
06:18 AM
I see below errors in the search head cluster.can some one helps resolve the issue?
02-11-2020 13:59:26.997 +0000 WARN ArtifactReplicator - Replication connection to ip=10.164.196.166:8999 timed out
02-11-2020 13:59:26.997 +0000 WARN ArtifactReplicator - Connection failed
02-11-2020 13:59:26.997 +0000 WARN ArtifactReplicator - event=artifactReplicationFailed type=ReplicationFiles files="/opt/splunk/var/run/splunk/dispatch/splunktemps/send/s2s/schedulerpbasav_ZWVfc2VhcmNoX3NwbHVua19zdXBwb3J0_RMD59b3a79690728a412_at_1581429480_498_638683B3-25D9-4D2A-AF2E-4E43362FDBFA-644D578C-F001-4711-B459-2338E22DF399.tar" guid=644D578C-F001-4711-B459-2338E22DF399 host=xx.xx.xxx.166 s2sport=8999 aid=746. Connection failed
we see some of the reports are generating without data and only some time..not sure what it is causing?
... View more
Labels
- Labels:
-
search head clustering
01-30-2020
06:54 AM
We have four indexer and replication factor is 2.replication port is on all indexer is 8080 and is enabled on all server.
We observed that indexer 2 and indexer 4 has lost the connectivity and they were not able to ping each other but indexer 1 can ping indexer 4 and indexer 3 can ping indexer 4 vice versa.Not sure what is the exact issue. can some one suggest on this?
Below is the complete error message
"Search peer indexer4-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs)"
... View more
- Tags:
- splunk-enterprise
12-27-2019
11:24 PM
HI Splunkers,
I see that swap being used and swap memory not getting released even though RAM is free.can you please advice what we can do in this case.
... View more
- Tags:
- splunk-enterprise
09-01-2019
08:18 AM
how it works without that
... View more
09-01-2019
08:18 AM
we do not have that attributes defined in our server.conf...
... View more
08-31-2019
04:26 AM
we are having 3 search head and they are in cluster. splunkd process went down in two search head. when i checked the master search head i see below mentioned error. i restarted splunkd issue got resolved but need to understand why this was happened as all scheduled searches and reports were failed during that duration.
WARN TcpOutputFd - Connect to :8999 failed. Connection refused
ERROR TcpOutputFd - Connection to host=xxxx:8999 failed
WARN ArtifactReplicator - Connection failed
... View more
- Tags:
- shc
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-19-2022
10:24 AM
|
