About anil15694

anil15694 · ‎12-22-2021

Hi Splunkers, We are using Splunk enterprise 8.2.2.1 and we can frequently see the IOWait health yellow or red. Although it is getting green it self after some time but it does not feel good if we see splund health yellow or red. So, I am looking some permanent solution for this. Please find the below message which I am getting. "Sum of 3 highest per-cpu iowaits reached yellow threshold of 7" Unhealthy Instances indexcr02.xyx.abc... Thanks.

anil15694 · ‎09-30-2021

Hi Splunkers, I am getting below error while configuring the SSL certificate among the splunk hosts. ERROR DistributedTracer [2406 MainThread] - Couldn't find "distributed_tracer" in server.conf. Can you help me on this?

anil15694 · ‎09-07-2020

Hi Splunkers, We are single site cluster environment. Which has 4 indexers,1 deployer,1 master and 3 search heads and loadbalancer mounted on the search head. Now We are migrating our splunk OS RHEL 6.x to Oracle linux 7.x. Just need guidance on the procedure and what are precautionary measures we need to take? We are migrating because red hat ending the support for RHEL 6.

anil15694 · ‎08-30-2020

Hi, I have set 35 days of data retention for an index but data is available for 288 days. The daily average licence uses by the index is approx 60 GB. Below is the current setting: frozenTimePeriodInSecs = 3024000 maxDataSize = auto_high_volume maxTotalDataSizeMB = 1500000 How I can modify indexes.conf to maintain the 35 days data retention policy. Thanks.

anil15694 · ‎08-17-2020

Hi, In order to remove an index, how can we be sure that the index is not getting used? What should we check before removing any index?

anil15694 · ‎08-16-2020

How to get list of apps and their average daily use.

anil15694 · ‎07-02-2020

How can I list out all the dashboards available in all the apps in my Splunk environment?

anil15694 · ‎08-22-2019

Hi All, We are having enterprise license version 7.2.4. Can we be able to do searches and indexing data after 5 license breach in a rolling month? As I know, if we are having No-enforcement license, Search will be enabled after 5 license breach but not sure about Indexing of new data will be enabled or not? Thanks

anil15694 · ‎05-16-2019

Hey @ashutoshab, Here you are creating schedule alert with time range 15 min so alert is getting run every 15 min. If you want your alerts should run and send email on every event so you should create real time alerts. Real - time alerts will be useful to monitor events or event patterns as they happen. You can use this splunk documentation as reference to create real-time alerts. https://docs.splunk.com/Documentation/Splunk/7.2.6/Alert/DefineRealTimeAlerts

Posts	9
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎05-02-2019

Online Status	Offline
Date Last Visited	‎12-29-2021 02:35 PM

splunk health status IOWait warnning

SSL certificate error: Couldn't find "distributed_...

How to migrate splunk OS RHEL 6.x to Oracle linux ...

How I can set 35 days data retention period for an...

How to find if a particular index is being used?

App Uses

All Dashboard Listing

Splunk License Breach and No-enforcement license