Splunk® Enterprise

Troubleshooting Manual

Download manual as PDF

Download topic as PDF

How to file a great Support case

When you contact Support, you can save time by starting out with everything we'll need!

Here are some ideas to get you started.

Describe the issue

Where does the issue occur? On a forwarder? On an indexer?

What elements are present for the issue? What's the timeline leading to the error? What processes are running when the error appears?

What behavior do you observe, compared to what you expect? Be specific: for example, how late is "late"?

Try to classify the problem:

  • Is it a searching issue? These include Splunk Web, management, roles, apps, views and dashboards, search language.
  • Is it a back end issue? These problems could include crashing, OS issues, REST API, or SDK.
  • Is it a configuration issue? These include extractions, input configurations, forwarding, apps disabling, or authentication.
  • Is it a performance problem?

Send diagnosis files

Most Support cases are for functional problems: the software has been configured to do something, but it is behaving in an unexpected way. Splunk Support needs both the context of the problem and insight into the instance that is not performing as expected. That insight comes in the form of a "diag," essentially a snapshot of the configuration of the Splunk platform instance and the recent logs from that instance.

You can make a diag on any instance type: forwarder, indexer, search head, or deployment server. If you have a forwarder and a receiver that are not working together correctly, send us diags of both. Label the diags so it's clear which instance each is from. If you have many forwarders, send only one representative forwarder diag.

The diag tarball does not contain any of your indexed data, but you can examine its contents before sending it. Read about what you can include or exclude from diags in Generate a diag in this manual.

Splunk Support might request another diag after recommending a change or update to the instance. This diag can verify that the change has been applied and examine its effect. It is not unusual to have multiple updated diags for a single case. If you send multiple diags, label each one clearly.

PREVIOUS
Contact Support
  NEXT
Generate a diag

This documentation applies to the following versions of Splunk® Enterprise: 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.5.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters