From Splunk Wiki
Troubleshooting your Splunk instance
- Troubleshooting Manual (Official Splunk documentation)
- Understanding General Splunk Topologies -- General Splunk Topologies and Roles(UF/LWF/HWF -> Intermediate Forwarders -> Indexer -> SH), and others
- Understanding How Indexing Works -- Diagram of Splunk Pipelines and Processors for indexing events
- Understanding How Distributed Search Works -- Diagram of A Search Flow
- General Troubleshooting
- Enable Debug Logging
- Troubleshooting scheduled saved searches
- Troubleshooting search quotas
- Troubleshooting Monitor Inputs
- Troubleshooting WMI Issues
- Troubleshooting Indexed data volume
- Troubleshooting data forwarding
- Troubleshooting Slow UI navigation/performance
- Troubleshooting Slow Indexing Performance
- Troubleshooting Distributed Search
- Troubleshooting Indexing -- which is largely redundant with ..
- Troubleshooting Blocked Queues -- mostly same as above
- Advanced Indexing Diagnostics: StdoutOutputProcessor
- Where do I configure my Splunk settings?
- Troubleshooting PDF Server
Tuning your Splunk instance
- Disappearing UDP packets
- General performance troubleshooting document
- Using the job inspector to investigate search performance
more coming soon!
Workarounds and other topics
- Manually Migrating user configuration in 4.0.5
- Changes to how arguments are passed to custom alerting scripts for 4.0.5
- What's that splunk install running?
- How to repair index after a crash
- How to Capture Windows Stack Traces Using Process Monitor
- Why does Splunk do math wrong?
What's this message mean?
How to contribute
Want to add information to an existing topic or create a new topic? Click here for instructions.