Splunk on Big Data

Could not send data to output queue (parsingQueue), retrying... The TailingProcessor message means that it was unable to insert data into the parsingQueue, which, as you might guess, is where event parsing...

Linux transparent hugetables support,  enabled="always" defrag="always" 1. Go to your Search Head OR Indexer and open a GUI :      https://:8000 2.  Go to "Searching and Reporting" Application from the "Apps" Menu on the...

The hard fd limit is lower than the recommended value. The hard limit is '4096' The recommended value is '64000'. 1. Go to your Search Head OR Indexer and open a GUI :  ...

  Usage of Splunk commands : ADDCOLTOTALS is as follows :  Computes and appends a new result with fields that represent the sum of   all values of numeric fields in the input   Find below...

Usage of Splunk EVAL Function : CASE  This function takes pairs of arguments X and Y.   X arguments are Boolean expressions  When the first X expression is encountered that evaluates to  TRUE,...

Usage of Splunk EVAL Function :  ABS is as follows : This Function takes the "Numeric Value" as an Input and returns its Absolute Value. Definition :              ...

Usage of Splunk commands :  ACCUM is as follows : Keeps a running total of a specified numeric field.                Find below the skeleton of the usage of...

We might need to replace the Master-Node for either of these reasons :  1.  The Node Fails 2.  We need to move the Master to a Different Machine or Site . For Example :...