Smart AnSwerS #73

Hey there community and welcome to the 73rd installment of Smart AnSwerS.

It has been almost a year since the very first members of the SplunkTrust Community MVP program were chosen by Rachel Perkins, Sr. Director of Community. SplunkTrustees have accomplished a lot of great work helping users through Splunk Answers, user groups, virtual .conf sessions, blogs, and giving talks at Splunk and industry events. It is now time for the next cohort for 2016-2017 to be selected by Rachel and the current members. Applications are now live as of last Friday, July 29th, and are due for submission by 12:01AM on Saturday, August 20th, 2016. Best of luck to all applicants!

Check out this week’s featured Splunk Answers posts:

How can I determine the lag between when an app’s scheduled search is supposed to run and when it actually runs?

nmiller shares this helpful question and answer with the community to help users identify the lag between the time a search is scheduled to run and the actual run time. She provides the run anywhere example search that can be used to look at searches for a particular app or all scheduled searches in your environment.

What are the expected results if a Splunk deployment server goes down for an extended period of time?

RJ_Grayson was concerned about what would happen with universal forwarder communication and deployment apps during a deployment server outage. esix explains that deployment clients will still try to contact the deployment server based on the phonehomeinterval, and reassured that apps would not get dumped or stop working. He also describes what happens with universal forwarders when the existing deployment server comes back online, or a new one is built.

How to search information on usage for each search from all the different apps in our Splunk environment?

ECovell needed to find usage data on each search for all apps to see what could be cleaned up or optimized for better performance, but wasn’t sure where to look or start. Ravan provides an answer with two useful searches that identify searches by app_name, which users are running them, disk usage, number of runs, and job run time information.

Thanks for reading!

Missed out on the first seventy-two Smart AnSwerS blog posts? Check ‘em out here!

Posted by