About sivakrishna

sivakrishna · ‎02-27-2024

Hi Rick, My apologize for that. I am not aware of this. We are actually rushing on this issue bcz its on priority in our PROD environment. I dnt know how to tag people earlier i have posted without tagging. I won't repeat this again. Regards, Siva

sivakrishna · ‎02-27-2024

Hi Team, We are facing discrepancy with Splunk License total usage vs Index wise usage. Could you please help us on this? Our Actual Splunk Stack is 50GB. 1. Index wise License Usage: for individual index for 1 index showing 65.46GB for the same day Total usage we are getting 55.42GB as shown in below screen shots. 2. Total License Usage: This is the Overall License usage for Feb 15. Kindly assist us with License Usage query based on index wise and it should match with the total License Usage and indicate any changes that need to be made at the server or configuration level. @gcusello @isoutamo @PickleRick Regards, Siva.

sivakrishna · ‎11-09-2023

Hi Team, We are planning to integrate Splunk with the ticketing system BMC Helix. So, we would like to know if it's possible to raise a ticket in the BMC Helix automatically if the knowledge objects are triggered? If yes what is the way to do that. Thanks in Advance Siva.

sivakrishna · ‎10-23-2023

Hi Team, We are observing discrepancy in calculation when the timestamp is less the 100ms. Example: Response time: “2023-10-23 14:46:14.84” Request time: “2023-10-23 14:46:13.948” When “Response time – Request time” value should be “136ms” but in Splunk it showing as “890ms”. While calculating Splunk is considering inbound value as ““2023-10-23 14:46:14.840ms” instead of “.84ms” as its in 2 digits. So, is there any possibility to resolve this discrepancy from the Splunk query level or .conf level. Regards, Siva.

sivakrishna · ‎09-27-2023

Still getting the same PORT issue @SanjayReddy

sivakrishna · ‎09-27-2023

Hi @SanjayReddy If i execute the above process check command getting the below.

sivakrishna · ‎09-27-2023

Thanks for the reply!! can we change the port for this server?? What will happen if i change the PORT for this single server when it's in the cluster? Remaining 3 servers are running on the 8191 PORT.

sivakrishna · ‎09-27-2023

Hi Team, We have 4 Search heads are in cluster in that one Search head is getting the KV store PORT issue asking that change the port remaining 3 SHs working fine. We are unable to restart the Splunk on that particular SH. If i check the SH cluster status only 3 servers are showing now. Splunk installed version: 9.0.4.1 for error visibility Please find the attached. Regards, Siva.

sivakrishna · ‎09-18-2023

Hi Team, We have 4 Search heads are in cluster in that one Search head is getting the KV store PORT issue asking that change the port remaining 3 SHs working fine. We are unable to restart the Splunk on that particular SH. If i check the SH cluster status only 3 servers are showing now. Splunk installed version: 9.0.4.1 for error visibility Please find the attached. Regards, Siva.

sivakrishna · ‎08-08-2023

I have already done the Splunk Reinstallation and checked the same issue occurring. 1. May I know How to clean the file system?? 2. Is there any issue will happen to the License file if we do these activities?? getting worried about License file.

sivakrishna · ‎08-04-2023

Hi Team, We have configured the DEV/TEST license in Splunk On-Prem standalone server. Its working fine on that day. But after onboarding logs the server, we are facing issue. when we click on settings==>Licensing==>getting the error like 500 internal server we are unable to see the License window. After onboarding logs also its showing "0%" license consuming out of 50GB in Monitoring Console. Checked the Splunkd.log getting the error. Please find the Screen shots FYR. Internal server error splunkd.log error web.conf

sivakrishna · ‎07-31-2023

Thanks, for the detailed Explanation. Now I got You.

sivakrishna · ‎07-31-2023

Hi Team, 1.We have the 50GB of DEV/TEST license file with us. After Configuring this License Can we create Knowledge objects like Dashboards, Reports and alerts.?? 2. Do we have any restrictions after configuring the DEV/TES License that prevent us from performing these tasks with the DEV/TEST license? In comparison to Enterprise 3. I want to configure this on a single server that serves as Heavy Forwarder Search head and the indexer. This makes sense, right?

sivakrishna · ‎07-31-2023

Thanks @richgalloway I tried with the double tunneling then it got worked out. Now Iam able to access the GUI of all servers.

sivakrishna · ‎07-31-2023

I tried the same thing as you suggested then Issue got Resolved. Thank you!!!

sivakrishna · ‎07-24-2023

Hi Team, I am unable to access the GUI after installation is done on the Splunk PROD server. I tried with IP Address, FQDN, Hostname but not working. It's getting worked with the TEST Servers but not with PROD servers. Getting this error when I tried to access the GUI.

sivakrishna · ‎07-24-2023

Getting this Splunkd.log 07-24-2023 09:54:21.053 +0100 ERROR BTreeCP [2041288 indexerPipe] - checkpoint failed: removal of dir. %s /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old: 1 error occurred. Description for first 1: [{operation:"failed to remove directory", error:"Directory not empty", file:"/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old"}]

sivakrishna · ‎07-24-2023

No Its newly installed Splunk server

sivakrishna · ‎07-24-2023

Getting this Splunkd.log 07-24-2023 09:54:21.053 +0100 ERROR BTreeCP [2041288 indexerPipe] - checkpoint failed: removal of dir %s /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old: 1 errors occurred. Description for first 1: [{operation:"failed to remove directory", error:"Directory not empty", file:"/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old"}]

sivakrishna · ‎07-24-2023

Hi Team, I am unable to restart Splunk on my Search head. Earlier its working fine but now it's not working. Due to this GUI of this Search head is also not able to access getting timed out. It's getting stopped here and no response I'm getting. I kept under observation up to 30min but no response. web.conf

Posts	21
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎07-23-2023

Online Status	Offline
Date Last Visited	‎02-27-2024 10:55 AM

Discrepancy with License Usage

Splunk Integration with BMC Helix

Discrepancy in calculation with Time Stamp.

Splunk KV store Issue

Splunk KV store Issue

Why is there Dev/TEST License Issue?

Splunk DEV/TEST License

Why am I unable to access the GUI after installing...

Why is Splunk Search head is not getting restarted...

Re: Discrepancy with License Usage

Discrepancy with License Usage

Splunk Integration with BMC Helix

Discrepancy in calculation with Time Stamp.

Re: Splunk KV store Issue

Re: Splunk KV store Issue

Re: Splunk KV store Issue

Splunk KV store Issue

Splunk KV store Issue

Re: Dev/TEST License Issue

Why is there Dev/TEST License Issue?

Re: Splunk DEV/TEST License

Splunk DEV/TEST License

Re: Unable to access the GUI after installing Splu...

Re: Splunk Search head is not getting Restarted..

Why am I unable to access the GUI after installing...

Re: Splunk Search head is not getting Restarted..

Re: Splunk Search head is not getting Restarted..

Re: Splunk Search head is not getting Restarted..

Why is Splunk Search head is not getting restarted...