We had very bad experience after we set  tsidxwritinglevel = 4. We use 8.1.1. Our indexers having huge memory spike and started to crash later find out that there was bug with 8.1.1 (SPL-197930)   https://docs.splunk.com/Documentation/Splunk/8.1.4/ReleaseNotes/Fixedissues ... View more

In our case the user was opening many tab and executing many searches that was causing the searches to auto canceling. After educating the user the issue is resolved. ... View more

    /opt/splunk/bin/splunk add oneshot "C:\csv\*.csv" -sourcetype csv -index csv_index -source test -auth admin:changeme   Can I use  *.csv to upload all .csv files in this folder in oneshot ? ... View more

I got this message also in the   12/30/20 6:38:38.240 PM   12-30-2020 18:38:38.240 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://proofpoint_tap_siem: query_and_save/Querying from 2020-12-30T23:37:37Z to 2020-12-30T23:38:37Z, but SIEM server returned: 400 Bad Request   ... View more

After commenting the line 217 ssl error disappear. But the log still not ingesting. I can see the below log in the splunkd.log but no log is ingesting.   12/30/20 6:12:37.069 PM   12-30-2020 18:12:37.069 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://proofpoint_tap_siem: query_and_save/Successful query from 2020-12-30T23:11:37Z to 2020-12-30T23:12:36Z   from ta_pps_ondemand_proofpoint_mail_log.log I can see only this message. No other errors resp = self.send(prep, **send_kwargs) File "/opt/splunk/etc/apps/TA-pps_ondemand/bin/ta_pps_ondemand/aob_py2/solnlib/packages/requests/sessions.py", line 646, in send r = adapter.send(request, **kwargs) File "/opt/splunk/etc/apps/TA-pps_ondemand/bin/ta_pps_ondemand/aob_py2/solnlib/packages/requests/adapters.py", line 516, in send raise ConnectionError(e, request=request) ConnectionError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/TA-pps_ondemand/TA_pps_ondemand_account?--cred--=1&output_mode=json&count=0 (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7fbe5c456210>: Failed to establish a new connection: [Errno 111] Connection refused',)) 2020-12-30 10:24:49,262 INFO pid=31191 tid=MainThread file=setup_util.py:log_info:117 | Log level is not set, use default INFO 2020-12-30 10:24:50,659 INFO pid=31191 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2020-12-30 10:24:50,660 INFO pid=31191 tid=MainThread file=splunk_rest_client.py:_request_handler:105 | Use HTTP connection pooling ... View more

@isoutamo  Yes I got some rest query. Just be curious is the dashboard you mentioned here is a custom developed or any app available?   ... View more

@richgalloway    Use the monitoring console to see what sources contributed a lot of data during the period of the slowdown.   I could not find the above option in the monitoring console. Could you give me the menu details  from the monitoring console or a scereenshot. ... View more

@inventsekar  yes this is a good approach. I have a question regarding the syslog. I am not very knowledgeable in syslog. Just want to clarify can we configure the network end device ( like CISCO ASA, Cisco switches etc) to send syslog into TCP port rather than UDp. As I know universally syslog use UDP port. ... View more

@richgalloway    If I shutdown one node alone can this case  search factor and replication factor met failure? Will the data generated during the shutdown period will be replicated to this nodes after we bring it up? ... View more

@richgalloway  I have a clustered indexers in a multi site environment. DO I need to shutdown the full cluster to run the   fsck command?   ... View more

@isoutamo  Do you mean one node completely fail or just unresponsive. when CM start this process What is the  process of restoring a comply failed node after a failure. How about the previous log this node was storing will it be automatically restored if we rejoin this node as a new fresh node with same disc structure. Do we need to manually copy the old log. ... View more