Troubleshooting your Splunk instance

• Troubleshooting Manual (Official Splunk documentation)
• Understanding General Splunk Topologies -- General Splunk Topologies and Roles(UF/LWF/HWF -> Intermediate Forwarders -> Indexer -> SH), and others
• Understanding How Indexing Works -- Diagram of Splunk Pipelines and Processors for indexing events
• Understanding How Distributed Search Works -- Diagram of A Search Flow
• General Troubleshooting
• Enable Debug Logging
• Troubleshooting scheduled saved searches
• Troubleshooting search quotas
• Troubleshooting Monitor Inputs
• Troubleshooting WMI Issues
• Troubleshooting Indexed data volume
• Troubleshooting data forwarding
• Troubleshooting Slow UI navigation/performance
• Troubleshooting Slow Indexing Performance
• Troubleshooting Distributed Search
• Troubleshooting Indexing -- which is largely redundant with ..
• Troubleshooting Blocked Queues -- mostly same as above
• Advanced Indexing Diagnostics: StdoutOutputProcessor
• Where do I configure my Splunk settings?
• Troubleshooting PDF Server

• Troubleshooting Alert Scripts
• Troubleshooting Splunk Crash Logs
• Troubleshooting Deployment Server

• Splunk Lock Files

• How to identify and fix corrupted buckets in Indexer Clustering(pre-v6.5)

Tuning your Splunk instance

• Disappearing UDP packets
• General performance troubleshooting document
• Using the job inspector to investigate search performance

more coming soon!

Workarounds and other topics

• Manually Migrating user configuration in 4.0.5
• Changes to how arguments are passed to custom alerting scripts for 4.0.5
• What's that splunk install running?
• How to repair index after a crash
• How to Capture Windows Stack Traces Using Process Monitor
• Why does Splunk do math wrong?

What's this message mean?

• CallbackRunnerThread took too long
• Metrics.log lines, and what they mean

How to contribute

Want to add information to an existing topic or create a new topic? Click here for instructions.