Hi All,  I have a requirement to add new members to the existing SH Cluster. I have gone through the below link where it explains about adding member to the SHC.  Add a cluster member - Splunk Documentation How do I Integrate it with the CM/Indexers? Do I need to do it after the above one? Is there any link? ... View more

I want to create an alert for which I am writing a search query but I am unable to filter using the time range picker.  since the events contains unix timestamp, I tried to convert but it fails during time range picker. can you help me what is wrong here? Query: index=isilon sourcetype="emc:isilon:rest" "memory threshold" | eval "Start Time" = strftime('events.start', "%d/%m/%Y %I:%M:%S %p") | table "Start Time" events.message Ideally when I run this query with time range picker on June 12th then there should be NO results,  but the results contains June8th events(attachment provided)   Sample event: {"events": {"devid": 8, "event": 400020001, "id": "8.794044", "lnn": 8, "message": "The SMB server (LWIO) is throttling due to current memory threshold settings. Current memory usage is 90% (23556 MB) and the memory threshold is set to 90%.", "resolve_time": 1686266238, "severity": "critical", "specifier": {"PercentMemoryUsed": 90, "PercentThreshold": 90, "ProcessMemConsumedInMB": 23556, "antime": 1686266290.600042, "devid": 8, "extime": 1686266290.490373, "kmtime": 1686266238.984405, "lnn": 8, "val": 90.0}, "time": 1686266238, "value": 90.0}, "timestamp": "2023-06-12 23:46:57", "node": "0.0.0.0", "namespace": "event"} {"events": {"devid": 8, "event": 400020001, "id": "8.793138", "lnn": 8, "message": "The SMB server (LWIO) is throttling due to current memory threshold settings. Current memory usage is 90% (23556 MB) and the memory threshold is set to 90%.", "resolve_time": 1686248504, "severity": "critical", "specifier": {"PercentMemoryUsed": 90, "PercentThreshold": 90, "ProcessMemConsumedInMB": 23556, "antime": 1686248570.519368, "devid": 8, "extime": 1686248570.447457, "kmtime": 1686248504.901769, "lnn": 8, "val": 90.0}, "time": 1686248504, "value": 90.0}, "timestamp": "2023-06-12 23:46:57", "node": "0.0.0.0", "namespace": "event"} ... View more

Hi All, I have created an alert which checks the status of the server and if it down, then alert will be triggered.  Query:  index=performance host=hostname1  source!=sar status!=UP | dedup hostname | table hostname status Sample Event: 2023-05-10 17:50:18 hostname1 server is DOWN 2023-05-10 17:55:18 hostname2 server is DOWN Now, I want to create an alert whenever the status changes from DOWN to UP. Can someone help with query? Thanks. ... View more

Hi All, I need to connect a new indexer cluster which are in GCP to an existing splunk SHC. I read the below document. Integrate the search head cluster with an indexer cluster - Splunk Documentation Integrate with a single-site indexer cluster Do I need to execute on all the SHC and then do a rolling restart? OR I need to execute on one SH, perform the restart and then follow the same on other SH? also, do I need to start with captain or non-captain? There is one more way, via GUI part: Enable the search head - Splunk Documentation It didn't mention whether I need to apply this on only one SH which is in cluster or on all the SH. can anyone help me with this? Thanks.  ... View more

Hi All, We are planning to migration KVstore storage engine from mmap to wiredTiger.  I know it is safe to disable kvstore on Indexers but I'm Just wondering what steps to approach if at all we need to upgrade storage engine from mmap to wiredTiger on Indexer Cluster.  ... View more

I have a field which contains http status code. I want to create a single alert query with multiple conditions.  Example: condition1) status code is 500 and greater than 10% alert should be triggered. Condition 2) status code is 403 and greater than 20% alert should be triggered.  Condition 3) status code is 503 and greater than 20% alert should be triggered.  Also, Is it possible to have different time range for the above condition? like condition 1 and condition 2 should search for last 15 minutes, whereas condition 3 should search for last 30 mins. How do I form the query? ... View more