About shankern

shankern · ‎03-26-2023

We use a private cloud and infact for the the KV Store status is showing as "starting" issue ingress to 8191 fixed the problem. There was no need for me to run the steps mentioned by sylim_splunk for my case.

shankern · ‎11-25-2022

Perhaps Splunk need to provide a proper solution for this

shankern · ‎11-25-2022

If savedsearches.conf already have a mix of disabled and enabled alerts this should not be used as it will enable all alerts when we do :1,$s/disabled=1/disabled=0/ for reenabling.

shankern · ‎07-30-2018

Is gzip content encoding header supported on HEC ? Would be useful while posting large payloads.

shankern · ‎06-10-2014

From the result the minTime values seems inaccurate. My splunk setup is only 1 month old but the minTime is giving timestamps from year 2011, 2012 etc. Any idea why? Thanks Shanker

shankern · ‎06-09-2014

Thanks 🙂 Gives me exactly what I wanted.

shankern · ‎06-09-2014

Hi, I would like to get the following stats in a distributed index setup: index name, current size of index (sum all indexers), maximum size/quota allocated, first events timestamp, last events timestamp, total retention time Thanks Shanker

Posts	7
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-09-2013

Online Status	Offline
Date Last Visited	‎03-27-2023 06:05 AM

Find index retention stats

Re: Why is the KV Store status is showing as "star...

Re: disable the all the alert?

Re: disable the all the alert?

Re: An issue with the HTTP Event Collector (HEC) h...

Re: Find index retention stats

Re: Find index retention stats

Find index retention stats