Smart AnSwerS #76

Hey there community and welcome to the 76th installment of Smart AnSwerS.

SplunkTrust member rich7177 graced us with his presence at HQ earlier this week, and was awarded an awesome trophy from the Splunk documentation team for always providing constructive feedback. Not only has he been helpful with improving the docs, but he’s an all-star on Answers too! Five of his many contributions have been featured in this Smart AnSwers blog series to date, with more to come I’m sure :) Congratulations Rich!

It’s a shame he couldn’t stick around until next week to join us for our monthly San Francisco Bay Area user group meeting next Wednesday, September 7th @ 6:30PM. If you happen to be in the area, come join us at Yahoo HQ! in Sunnyvale to listen in on talks by burwell from Yahoo and jonathon from Groupon. Visit the SFBA user group page for more details and to RSVP.

Check out this week’s featured Splunk Answers posts:

How to troubleshoot why startup.handoff in the Search Job Inspector always seems to take a long time?

gustavomichels noticed search performance issues and looked in the Search Job Inspector to find that startup.handoff was taking up most of the time to execute a search. sjohnson includes the definition of startup.handoff from documentation in his answer, and also shares several factors that contribute to this taking a long time from his own experience and observations. He finishes off his solid response by showing how to troubleshoot which one could be the culprit.

What is the difference between the srchJobsQuota and cumulativeSrchJobsQuota settings in the authorize.conf role stanzas?

kwasielewski wanted to set the search quota for a role, but didn’t know if one or both of these settings in authorize.conf should be used. Raghav2384 provides explanations for both srchJobsQuota and cumulativeSrchJobsQuota with a link to supporting documentation, and gives examples defining these parameters for a role to demonstrate the differences and how they work.

Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors?

serwin was require to scan his Splunk Enterprise environment for compliance reasons, and kept getting multiple SSL errors for the management port 8089 on search heads and indexers. Masa knocks it out of the park by addressing how to resolve each error in the list, and adds the appropriate links from documentation and a previous Splunk Answers post.

Thanks for reading!

Missed out on the first seventy-five Smart AnSwerS blog posts? Check ‘em out here!

Posted by

Show All Tags
Show Less Tags