About Marko

Marko

How can i resolve this error "Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure". I keep getting this error on splunkforwarder when i run SPLUNK_HOME/splunk list monitor, SPLUNK_HOME/splunk list inputstatus.

Marko

Thanks @deepakc

Marko

I'm investigating why Splunk is keeping data beyond retention period stated in frozenTimePeriodInSecs? How can i fix this?

Marko

@deepakc Is there a formula i can use to determine the right diskSize, maxTotalDataSize, maxWarmDBCount? I think that will help me set the right values for these parameters.

Marko

From your answer, maxTotalDataSizeMB is the same size as diskSize. That's the reason it's rolling off. Still don't know which of the parameters to tune to get it fixed.

Marko

Thank you so much @deepakc Your answer has been very helpful!

Marko

I'll check them out, thanks! @isoutamo

Marko

Hello guys.... I have this task to investigate why indexes roll of data before retention age. From my findings, it shows number of warm buckets exceeded. Here's what the index configuration looks like. How can i fix this? [wall] repFactor=auto coldPath = volume:cold/customer/wall/colddb homePath = volume:hot_warm/customer/wall/db thawedPath = /splunk/data/cold/customer/wall/thaweddb frozenTimePeriodInSecs = 34186680 maxHotBuckets = 10 maxTotalDataSizeMB = 400000

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-19-2024

Online Status	Offline
Date Last Visited	Sunday

Couldn't complete HTTP request

Why is Splunk keeping data beyond retention period

Index rolling off data before retention age

Couldn't complete HTTP request

Re: Why is Splunk keeping data beyond retention pe...

Why is Splunk keeping data beyond retention period

Re: Index rolling off data before retention age

Re: Index rolling off data before retention age

Re: Index rolling off data before retention age

Re: Index rolling off data before retention age

Index rolling off data before retention age