Splunk Reactions @splunkreactions - Tumblr Blog

When you double up on a PS engagement, and you're busy writing config while your buddy is "convincing the firewall guy to open the port"

My conclusion after talking with any L1 Support person

When a customer has a perfectly fine instance, but they're paranoid and book you and your buddies to do PS

As the only PS in a customer meeting, surrounded and outnumbered by pre-sales

Yeah, sure.

When you are convinced this is the one time it isn't a typo or permissions, but it turns out to be... a typo. In a file with the wrong permissions.

When I start seeing complaints about replication failure

Thanks, Jackson!

When the parsing queue is blocked...

When you try and get away with using below reference hardware specs on your indexers.

/opt/splunk/bin/splunk restart when you're "Quite sure" your conf edit will work...

When search fails and the monitoring console is reading your indexers' eulogies, but the cluster master thinks they're all fine

Also, I still haven't fixed this one yet, so any suggestions greatly appreciated...

When you're doing a health check and to your utter disbelief it's so good you have to end a five day engagement on day one.

How the customer thinks you must view the world when you immediately spot a single character error in a 300 character regex

When you finally build up enough experience as PS to be confident you can fix your inevitable mistakes...

Every cluster bundle push ever...

splunk show cluster-bundle-status restart_required = 0

Splunk Reactions