Hi   We are trying to integrate the data which is on Splunk to ELK, Using Heavy forwarder can anyone suggest how inputs.conf can be configured so that it listens to the data which is on search head and then using outputs.conf we can send the data to ELK via stash   Thanks  ... View more

Hi    1 bucket stuck at “fixup task pending” state with below error. I tried restarting Splunk, Re-sync and roll but its not working. Can anyone suggest the possible solution in order to troubleshoot the issue   Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ site3:1 } ... View more

We have recently migrated to smart store post migration SF and RF are not met. Can anyone help me with the  troubleshooting steps. ... View more

Hi i am trying to build a dashboard and I require a query to execute below some searches below:  1. REPORT FALSE POSITIVE PER TOTAL  2. REPORT MONTHLY SPLUNK ALERT HIGH - MEDIUM - LOW Can anyone help me in building the same? ... View more

Hi   How to delete only specific data from the specific index(note: not the entire data)in clustered environment ... View more

Can you please let me know what is the max data ingestion limit when we use hec service? ... View more