#splunkreactions

[splunkreactions]

Hits "Enter" on search and immediately realizes he's missing a quotation mark and the search will fail...

#TheStoryOfMyLife

[splunkreactions]

As the only PS in a customer meeting, surrounded and outnumbered by pre-sales

[splunkreactions]

[splunkreactions]

Yeah, sure.

[splunkreactions]

When you are convinced this is the one time it isn't a typo or permissions, but it turns out to be... a typo. In a file with the wrong permissions.

[splunkreactions]

When the parsing queue is blocked...

[splunkreactions]

When you try and get away with using below reference hardware specs on your indexers.

[splunkreactions]

/opt/splunk/bin/splunk restart when you're "Quite sure" your conf edit will work...