How to calculate Latency Over Last Minute, Total Requests/min, LBs with Highest Unhealthy Host % in the load balancer dashboard. We are facing some production issue and i just try to figure out the root cause from Splunk but could not able to fetch the correct report for latency. Can some one please help me in this. We are using Splunk cloud instance. The following field we have in the ELB logs timestamp, elb, client_ip, client_port, request_processing_time, response_processing_time, elb_status_code, received_bytes, ssl_cipher,  ssl_protocol, request, backend_processing_time, backend_status_code Any help on this would be appreciated ... View more

HI all, I am new in splunk admin and doing a poc on archiving the frozen bucket data to the s3 bucket. Can I directly provide the s3 Url in the splunk web under index setting or do i need to provide the archive script in the coldtofrozen directory. Also while setting the archiving policy do I need to change only frozenTimePeriodInSecs or do I need to change both maxTotalDataSizeMB  and frozenTimePeriodInSecs. Please excuse this silly question as i am new in Admin i am looking for the best practise 🙂   ... View more

I am using Splunk trail version and recently received the message "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch.". I checked in splunk community and Splunk documents and as per the solution suggested i changed the free disc space to 20000 mb through splunk web. But still receiving the same message. And because of this error the indexing has been stopped and dashboard display no data. Also made the changes in the main and the audit index by reducing the TSIDX file older than 30 days but still receiving the same message. Can anyone please help me finding the solution as I am new in Splunk and not very proficient in Admin part. Do I need to increase the Instance size, currently I am using T3 Large(120 GB  ). requesting every Splunk professional to suggest a solution ... View more

I have a splunk trial version and i am trying pushing aws waf logs through HEC- I have enabled the token perfectly and also tried with several endpoints, but it dint worked. Most of the Splunk documents has a guide for splunk cloud instance on how to enable the endpoints but i could not find any documents which says how to configure the endpoints for splunk enterprise trial. Meanwhile i tried with the all the three way of endpoints <protocol>://<host>:<port>/<endpoint> <protocol>://input-<host>:<port>/<endpoint>  and <protocol>://http-inputs-<host>:<port>/<endpoint>   ... View more

I am using Splunk cloud instance and i could not see the INVITE USER option in instance page. It disappear suddenly. I had invited many user through Invite user option but all of the sudden this option is missing. Can someone please help me in this ... View more

I have pushed all my sourcetype in the main index since it was streaming through single app. Now i required to move the data from main index to a new index and i am using splunk cloud instance. So can anyone please help in migrating the data from main index to the new index in splunk cloud instance ... View more

i am trying to cofigure a search head cluster and getting an error socket_error= connect timeout while electing the captain. I have configured the deployer and the 3 search head successfully and also initiated the cluster on all three instance. I also restarted all three splunk search head server before electing the captain. tested all ports connectivity but still getting an error while running a shcaptain command - ./splunk bootstrap shcluster-captain -servers_list ":,:,..." -auth : I have followed all the steps very carefully but still cant able to elect one search head as a captain Note-1- I am not running the above the command in deployer. Running it on the search head member 2- the URI and the managment port in the above command i have given for the search head members with https and 8089 with comma seperated. Please someone help me in resolving this issue its urjent ... View more

i am using Splunk enterprise trial version and trying to push the windows logs to Splunk from the customize location . I gave the path location of my file which i want to push in /etc/system/local folder inside input.conf file and restarted the splunk server but still i could not able to see the file in splunk. I have followed the below documents to add the stanza in the input.conf file https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorfilesanddirectorieswithinputs.conf Can anyone please guide me in this as how to push the file ti splunk from a customize location Note- I made the changes in the input.conf file inside splunk universal forwarder directory as i dont have $splunk_home file directory ... View more

I am having Splunk self serviced cloud deployment whose licence is getting expired on 2nd Feb 2020 but when i am loading the dashboard it shows an error message- "Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK." Please help me in resolving this error as it is very urgent. ... View more

I am having Splunk self-service cloud deployment and trying to install the UF(Universal forwarder). After installing forwarder and universal forwarder credentials, I could not able to see the forwarders. I have an access to the server where the forwarder is installed and also restarted the Splunk server many times, but still I could not see the installed forwarder. Note- I installed the splunk cloud instance trialled version . There I could installed the forwardersuccessfully but could not able to push the windows log to splunk. The receiving port (9997)configuration option is not available. Please help in resolving these issues. ... View more