cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
drdosia
Explorer
Member since: ‎04-15-2011
‎06-05-2020
Community Statistics
Posts 6
Solutions 0
Karma Given 1
Karma Received 4
Member Since ‎04-15-2011
Activity Feed
View All

Re: Seeing old splunk search pids

by in Deployment Architecture
‎07-13-2015 03:12 PM
‎07-13-2015 03:12 PM
Has this issue reappeared? By any chance do you have the *nix app? The sourcetype=ps is used by the PS- All process info search in the *NIX app. What version of *NIX app are you running? Check if you are current. Cheers, Doc ... View more

Re: How do I list all the saved searches for an Ap...

by in Reporting
‎01-23-2015 07:17 PM
1 Karma
‎01-23-2015 07:17 PM
1 Karma
Follow-up The answer by martin_Muller works, but be aware that you need to be logged in as a user that has access to Your_app | rest /servicesNS/Your_user/Your_app/saved/searches | table eai:acl.app author title search Note, unless you are an admin role you will not see the "private" non-shared saved searches Many thanks to martin_mueller for a quick answer! ... View more

Re: Splunk universal forwarder fails to start - AI...

by in Getting Data In
‎01-23-2015 06:27 PM
‎01-23-2015 06:27 PM
We had the same issue with all versions of 6.1.x , 6.2 and the last tried was 6.2.1. We resorted to replacing all of our startup scripts with Wrapper scripts like the one recommended by pit4getit . That solves the issue for us but not a recommended final fix due to the extra work of replacing the startup scripts. ... View more

How do I list all the saved searches for an App in...

by in Reporting
‎01-23-2015 06:15 PM
3 Karma
‎01-23-2015 06:15 PM
3 Karma
I have tried this: | rest /services/saved/searches | table title search I got only 36 results. I then tried | rest /services/saved/searches | table *** to see all the fields. **eai:acl.app matches what should show the Splunk App that the saved searches come from. I got 36 results and eai:acl.app had "search" for all 36 of them. They match the saved searches in the search App. I was running this as an id with the Admin role that should see all Apps. I have over 100 Apps with anywhere from 3 to 70 saved searches each. It does not matter that I am in any particular App (context). I get the same results only showing the 36 from the search App. How do I list the saved searches from one (or more) of the other Apps? This is on version 5.03 ... View more

Re: Splunk universal forwarder fails to start - AI...

by in Getting Data In
‎06-11-2014 12:32 PM
‎06-11-2014 12:32 PM
We are running splunkforwarder-6.1.1-207789-AIX-powerpc. We succesfully had it start and run for 2 day but today we get the exact same error as above. We checked that all files and directories under .apps/splunk (where all our instances go) are owned by the correct splunk service account. We are stumped. Any suggestions? ... View more

Re: Universal forwarder high CPU and memory usage

by in Getting Data In
‎07-21-2011 01:56 PM
‎07-21-2011 01:56 PM
I would love to know the total number of files you have in the directories listed in your inputs.conf file. I have several AIX Universal forwarder instances that are very similar data wise and identical physically. 2 instances have very high CPU usage by Splunkd. (averaging 12 to 14%) The only difference I can find between them is the number of files in the monitored directories. The total number of files on the High CPU usage machines totals between 8 and 9 thousand. 6,500 are in one directory alone. All the other Instances have less than 2 thousand files to track with CPU utilization being very low. (averaging less than 1% CPU) I am wondering what is the maximum number of files one can track before cpu utilization jumps above an average of 8%? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All
Karma given to
View All