Hello Experts, We have migrated to new hardware after old data is backed up , new environment has last 2 months of data . Now we want to restore old data onto a standalone server to perform some searches .  Highlights  --> old backup has primary and replication buckets as it was cluster backup. --> we are planning to setup a test machine(indexer/search head) for the above and ask storage team to mount (~450TB (primary and secondary ) buckets). Do you think it is a right approach ? is there anything that we need to consider before we ask a test machine (8GB RAM , 4 CPU) and storage team to mount 450TB(backup) to this test machine .  ... View more

Hello Splunk ES experts , My Splunkd is crashing frequently with below error in crash logs C++ exception: exception_addr=0x7ff2c2c3c620 typeinfo=0x556c38241c48, name=St9bad_alloc Exception indicates memory allocation failure This started after ES app installation . I have checked with free command I have plenty of  memory on the system 32GB and 16 CPU                total                 used            free                   shared           buff/cache           available Mem: 32750180     1764936    19979208     17744               11006036         31040488 Swap: 4169724          0                   4169724   Below are my ulimit settings  splunk soft nofile 65535 splunk hard nofile 65535 splunk soft nproc 65535 splunk hard nproc 65535 Any suggestions please  ... View more

HI Experts, I am sure someone must have faced this issue with Web Analytics 2.2.1 Splunk 7.2.5 (SHC, Index Cluster as I have seen similar posts but no concrete Answer . I am aware that when we install this app we will get Web data model.Because i already have CIM so I have cloned this data model and named it "Web Analytics" . I can see the data as it is properly tagged (tag=web), this gives me the results as expected. I have accelerated this data model for summary range 1 day. Till 99.98% it completed in 30 min but then it stuck for like 48 hours now , as shown below . I tried rebuilding it still same status MODEL Datasets 3 Events, 1 Search Event Edit Permissions Shared Globally. Owned by nobody. Edit ACCELERATION Rebuild Update Edit Status 99.98% Completed Access Count 0. Last Access: - Size on Disk 1.91 GB Summary Range 86400 second(s) Buckets 1006 Updated 5/10/20 7:04:00.000 PM" I do not know if because of this dashboards like (Analytics Center,Audience,Acquisition,Behavior Overview) are blank . Couple of other observations Below query does not produce any results as Web.eventtype=pageview produce no results | tstats summariesonly=t prestats=t dc(Web.http_session) FROM datamodel=`datamodel` WHERE Web.site="*" Web.eventtype=pageview GROUPBY Web.http_session,Web.ua_mobile _time span=1d | timechart span=1d dc(Web.http_session) by Web.ua_mobile | rename Web.ua_mobile AS "Mobile Device " | fields - VALUE I have also checked Document link in the app itself and can see below Web Server Log Data check (tag=web | head 5) check completed Website Configuration check --table is showing results Lookup check --(Sessions,Pages) ---check completed Data Model Acceleration check --98.99% Any help will be highly appreciated. | tstats summariesonly=t prestats=t count FROM datamodel=WebAnalytics --> Produce no Result | tstats count FROM datamodel=WebAnalytics --> Produced results VG ... View more

Hi Experts, I have 2 Splunk cloud setup one for Europe and other is for USA . How can I give a common layer (SH) in this case ? Regards VG ... View more