Hi,  i am trying to search for host that are sending logs over the last 7 days. Anything more than 7 days i will like to exlcude out from my results.  Right now i am using this query and searching over the last 7 days.  =================================================== | metadata type=hosts index=* | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" host as "Hostname" | table Hostname Count "First Event" "Last Event" "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%d-%m-%Y %k:%M") | fieldformat "Last Event"=strftime('Last Event', "%d-%m-%Y %k:%M") | fieldformat "Last Update"=strftime('Last Update', "%d-%m-%Y %k:%M") | sort by "Last Update" | reverse ================================================== This query give me what i wanted but towards the end of the results, those last updated time include those hosts which last send over few months ago.      Anybody can enlighten me what i should do for results only lasting last 7 days till 28 Jab 2022?       ... View more

My indexer is totally full now and new items cannot be index.  The previous settings also seems to be not working.  [root@splunk-masternode local]# cat indexes.conf homePath.maxDataSizeMB = 80000   # Hot and Cold - External data sources [volume:secondary] path = /splunk/splunkdata maxVolumeDataSizeMB = 1650000   I have tune the maxDataSizeMB to 40000 instead and the maxVolumeDataSizeMB to 155000 instead and restarted but its not clearing off.    /dev/mapper/splunk_hotbucket-hotbucket 1.8T 1.7T 4.9G 100% /splunk/splunkdata The 1.65T limit also seems to be not working as its now 1.7T.    Anybody have any advise? This is currently my 2 indexes.conf settings.  [root@splunk-masternode local]# cat indexes.conf # VOLUME SETTINGS # In this example, the volume spec here is set to the indexer-specific # path for data storage. It satisfies the "volume:primary" tag used in # the indexes.conf which is shared between SH and indexers. # See also: org_all_indexes # One Volume for Hot and Cold - Splunk default internal indexes [volume:primary] path = /splunk/splunkdata_internal # Note: The *only* reason to use a volume is to set a cumulative size-based # limit across several indexes stored on the same partition. There are *not* # time-based volume limits. # ~5 TB maxVolumeDataSizeMB = 5120 # Hot and Cold - External data sources [volume:secondary] path = /splunk/splunkdata maxVolumeDataSizeMB = 1550000 [volume:cold] path = /splunk/splunkdata_cold #[volume:frozen] #path = /splunk/splunkdata_frozen # This setting changes the storage location for _splunk_summaries, # which should be utilized if you want to use the same partition # as specified for volume settings. Otherwise defaults to $SPLUNK_DB. # # The size setting of the volume shown below would place a limit on the # total size of data model acceleration (DMA) data. Doing so should be # carefully considered as it may have a negative impact on appilcations # like Enterprise Security. # [volume:_splunk_summaries] path = /splunk/splunkdata # ~ 100GB # maxVolumeDataSizeMB = 100000   homePath.maxDataSizeMB = 40000       ... View more

Previously, my heavy forwarder is working fine. Able to search from latest logs in my searchhead. But upon testing another app for another SIEM in the heavy forwarder, it has been routing to there since. But after the POC ended, we want to switch back to sending it back to our splunk indexer.  We remove the app for the SIEM and left with our outputs for this forwarder which is towards the splunk indexer IP. I tried restarting the splunk service in this heavy forwarder but still unable to search those host in the searchhead.  Is there anything to look out for?  ... View more

Hi all,    I have install splunk forwarder in 1 centos device, sending to indexer.  From the search head, i can see data from this host but the the index is put as Main.  On the app, we have already specify to another index and we verified that the index is created.  Anybody know what am i missing? Already restart splunk services for both host and searchhead.    ... View more

Hi all, i am new to splunk and face with a scenario.  We have install a forwarder on 1 of our production solaris device, intending to send logs to Splunk for monitoring purpose. On the Forwarder Management, we can see that this solaris host is phoning home, which suggest that its connecting to the Splunk. App: Host is deployed to the Sol-prodweb app, which have an inputs.conf. This content inside list the path that suppose to be monitor, eg: [monitor:///var/adm/authlog] index=sol-prodweb sourcetype=linux_secure disable=0 We have also verify that the indexes page have the sol-prodweb detail and that the //var/adm/authlog path does have logs inside.  Server class: we also have create a sol-prodweb , with this device IP inside the whitelist .   Any important settings or steps that we miss out cause we are still unable to see any logs or data from this particular host at all? ... View more