About mussab

mussab · ‎03-14-2019

I have used the same Add-on and it works fine for me it is CIM comply.

mussab · ‎09-25-2018

We have four indexers and we want to add an archiving path. What is the best solution to do this? Is it by creating 4 different file mounts (one for each indexer) or having one file mount accessible by all indexers. note: we are using SAN storage

mussab · ‎08-19-2018

The issue has been fixed; when I checked the log files I noticed below error 08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

mussab · ‎08-18-2018

When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated Splunk Version: 7.1.2 Lab environment

Posts	4
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎08-18-2018

Online Status	Offline
Date Last Visited	‎09-22-2022 05:38 PM

What is the best practice for mounting the archivi...

When any new data is uploaded to Splunk to review ...

Re: How can i parse syslog barracuda email securit...

What is the best practice for mounting the archivi...

Re: When any new data is uploaded to Splunk to rev...

When any new data is uploaded to Splunk to review ...