[ind2] HomePath = $SPLUNK_DB/ind2/db ColdPath = $SPLUNK_DB/ind2/colddb ThawedPath = $SPLUNK_DB/ind2/thaweddb MaxHotBuckets = 10 MaxDataSize = 10000 MaxWarmDBCount = 300 MaxTotalDataSizeMB = 50000 FrozenTimePeriodInSecs = 31536000   ColdToFrozenDir = $SPLUNK_DB/ind2/frozendb   In this config how long data will reside in each bucket as per my understanding after 10gb data in hot ll roll to warm and when 300 bucket in warm ll full that ll roll to cold  or 10 hot bucket each bucket in hot ll take 10gb data than it ll roll to warm is there aany one who can clarify???  ... View more

  in my standalone environment i have configured like this...i want to know about volume . and also if l ll set coldToFrozenDir=$SPLUNK_DB/ ind1/frozendb that ll  create folder externally???  [ind1] homePath= $SPLUNK_DB/ind1/db coldPath= $SPLUNK_DB/ind1/colddb thawedPath= $SPLUNK_DB/ind1/thaweddb maxHotBuckets=10 maxDataSize=10000 maxWarmDBCount=300 maxTotalDataSizeMB=200000 frozenTimePeriodInSecs=31536000  coldToFrozenDir=$SPLUNK_DB/ ind1/frozendb   ... View more

hi In my index i have added this things  [ind1] homePath= $SPLUNK_DB/ind1/db coldPath= $SPLUNK_DB/ind1/colddb thawedPath= $SPLUNK_DB/ind1/thaweddb maxHotBuckets=10 maxDataSize=10000 maxWarmDBCount=300 maxTotalDataSizeMB=200000 frozenTimePeriodInSecs=31536000  coldToFrozenDir=$SPLUNK_DB/ ind1/frozendb   that means after 1 year data will be deleted ?? if i ll not add volume for this it ll affect my index or what??? please help on this ... View more

Hi  We have a stand alone environment in which daily 100 GB data will be ingested,  just want to know what would be the best index storage configuration in indexes.conf. i have no. of indexes i want to configure like this [active-directory] homePath= $SPLUNK_DB/active_directory/db coldPath= $SPLUNK_DB/active_directory/colddb thawedPath= $SPLUNK_DB/active_directory/thaweddb maxHotBuckets=3 maxDataSize=300 maxWarmDBCount=300 maxTotalDataSizeMB=200000 frozenTimePeriodInSecs=172800  coldToFrozenDir= $SPLUNK_DB/ active_directory /frozendb   Can someone will help with suitable configuration, and what would be the disk space required to storage if i ll config foe all indexes , ll i  face any disk space issue?? ... View more

how to send syslog events from prisma cloud to splunk enterprise ... View more

after installing nagios addon on splunk web showing page not found is there anyone who can help on this??? ... View more

After installing Splunk Add-on for Nagios it's showing "page not found". Can anyone tell me why this might be happening? ... View more

hi team  Query 1(panel 1) index=" " Message="*POWERING_ON*" host=" " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName |eval time= strftime(time,"%d-%m-%Y %H:%M:%S")| stats count   query2(panel 2) result=24 index="  " Message="*VM_STATE_POWERING_OFF*" host="  " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | append [| search index="  " "ha-datacenter is powered off" host="  " | rex "\s\:\s+(?P<VMName>.+)\son.\s" | stats latest(host) as host, latest(_time) as time by VMName] | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | dedup VMName | stats count result=10   how i ll comine 2 query and get 1 panel with sum of  24+10=34 ... View more