Digital Resilience Pays Off
Download this e-book to learn about the role of Digital Resilience across enterprises.
Hey there community and welcome to the 71st installment of Smart AnSwerS.
There’s a lot of hustle and bustle going on as Splunkers, partners, and customers are preparing and reviewing presentations for .conf2016 just two months away. As we all wait in anticipation for the annual worldwide user conference, come join the community in a sneak peek of one of the sessions at next week’s July SplunkTrust Virtual .conf session. On Friday, July 29th @ 3:00PM Pacific time, SplunkTrustee Mason Morales will be giving a preview of his .conf2016 talk: Architecting Splunk for Epic Performance. Visit the meetup page to RSVP and access the WebEx link for the event.
Check out this week’s featured Splunk Answers posts:
a212830 was seeing this message appear frequently on a search head, and could not find much material on why this happens. There have been several questions asked on related topics, but these have focused more on how to clean up the dispatch directory. sowings and yannK both contributed answers that addressed the underlying causes of this behavior. They educate the community on what the dispatch directory is, its purpose, the types of search artifacts that get stored there, and why the TTL (time to live) varies for each one.
https://answers.splunk.com/answers/213571/what-causes-too-many-search-jobs-found-in-the-disp.html
packet_hunter was concerned about predicting how much disk space would be consumed by creating and testing different data models, especially with little extra storage or license to work with. shaskell explains how this depends on the type of data model, acceleration, and the period of acceleration. He shares a lot of great resources from Splunk documentation on inspecting acceleration, precautions, differences between ad hoc versus persistent acceleration, and how to limit the amount of disk space used for data model summaries.
https://answers.splunk.com/answers/425565/how-does-creating-a-data-model-affect-storage-and.html
Urias was told to use the stats command instead of transaction, but noticed there were fewer fields returned from the search. Stats was recommended for performance reasons, but Urias wasn’t sure if this was still the right way to go if it meant getting limited results. craigv covers the differences between the two commands, how they operate, and whether or not you can get the same functionality using one or the other based on your use case.
https://answers.splunk.com/answers/424769/why-am-i-getting-less-fields-returned-from-a-searc.html
Thanks for reading!
Missed out on the first seventy Smart AnSwerS blog posts? Check ‘em out here!
http://blogs.splunk.com/author/ppablo
----------------------------------------------------
Thanks!
Patrick Pablo
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.