About Nahra

Nahra · ‎07-30-2019

I believe each of those panels will allow you to look at the full Search string. I would start there and see what the differences are between the two searches, it may just be a simple update to a field on the first panel.

Nahra · ‎09-10-2018

You could try to use the "Run a Script" option in the Scheduled Report. http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Schedulereports#Run_a_script You could setup a script that would compress the report and then email it via the server's mail application.

Nahra · ‎01-12-2017

Looks like a new deployed was created that monitored the IIS log location and the old deployed app was removed. Would that cause Splunk to re-index? I thought that data was separate from the app.

Nahra · ‎01-12-2017

Recently, my Splunk environment decided to re-index ALL of my IIS logs (which crushed my daily license quota). I have been tasked with finding the root cause of why that happened. Is there anyway to find in the Splunk logs why it decided to re-index all these logs?

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-22-2014

Online Status	Offline
Date Last Visited	‎04-25-2023 11:46 AM

How to find out why Splunk Indexer re-indexed my I...

Re: Splunk App for Windows Infrastructure: Receivi...

Re: Can you compress Splunk reports before sending...

Re: How to find out why Splunk Indexer re-indexed ...

How to find out why Splunk Indexer re-indexed my I...