cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
osec2a
New Member
Member since: ‎08-07-2017
‎11-15-2022
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-07-2017
Activity Feed
View All

Re: JSON data with date not indexed

by in Getting Data In
‎08-31-2017 04:57 AM
‎08-31-2017 04:57 AM
My data are outputed by python script. My script output is json data. When the script output is {"test1":"2017-08-31", "test2":"12.34.56"}, data are not indexed, but when I delete the dot ".", data are indexed. ... View more

JSON data with date not indexed

by in Getting Data In
‎08-31-2017 01:06 AM
‎08-31-2017 01:06 AM
Hi, I am trying to index JSON data but Splunk refused to index it and I have no errors in logs. The format of my data is : {"test1":"2017-08-31", "test2":"12.34.56"} I tried many format : {"test1":"2017-08-31", "test2":"12.34.56"}" => not indexed {"test1":"12.34.56", "test2":"2017-08-31"}" => not indexed {"test1":"2017-08-31", "test2":2017/08/3"}" = > indexed successfully {"test1":"2017.08.31", "test2":17.08.3"}" => indexed successfully {"test1":"2017_08_31", "test2":17.08.3"}" => indexed successfully Why Splunk doesn't want to index my JSON with these data : {"test1":"2017-08-31","test2":"12.34.56"} Thanks for your help ... View more

Re: Bucket number exceeds maxHotBuckets value

by in Deployment Architecture
‎08-09-2017 07:04 AM
‎08-09-2017 07:04 AM
I add an answer beacause I can't add img in comments ... View more

Re: Bucket number exceeds maxHotBuckets value

by in Deployment Architecture
‎08-07-2017 07:46 AM
‎08-07-2017 07:46 AM
@mmodestino This is my configuration in moniroting console When I use dbinspect command to display each nomber of bucket per indexer this is what I get : How can indexer have more than 3 (maxHotBuckets) hot buckets? Thanks ... View more

Re: Bucket number exceeds maxHotBuckets value

by in Deployment Architecture
‎08-07-2017 06:17 AM
‎08-07-2017 06:17 AM
In server.conf parallelIngestionPipelines value is 1, so the maximum number of hot bucket is always 3. ... View more

Re: Bucket number exceeds maxHotBuckets value

by in Deployment Architecture
‎08-07-2017 06:15 AM
‎08-07-2017 06:15 AM
I have a distributed envrironment, so I manage all my indexers on a deploployer server I don't think it is counting replicated hot buckets. When I use dbinspect command, I see the same result ... View more

Bucket number exceeds maxHotBuckets value

by in Deployment Architecture
‎08-07-2017 02:46 AM
‎08-07-2017 02:46 AM
Hi, In my splunk configurtation I have defined the maxHotBuckets to default value, so 3. When I monitor my indexers I see that the number of Hot buckets exceeds the value 3. Can anyone explain me why the number of hot buckets can exceed the maximum number of hot buckets? Thanks ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-15-2022 10:47 AM