Deployment Architecture

Community Activity

What is the compression ratio of raw data in Splunk? Hi Team, Any one please let me know what is the compression ratio of raw data in Splunk? I heared that its 10:1 rati... by lal37 Explorer in Deployment Architecture 01-08-2025 1 7	1	7
Splunk Storage Sizing Guidelines and calculations Hi Team, I have doubt with Splunk Storage Sizing apps https://splunk-sizing.appspot.com/#ar=0&c=1&cf=0.15&cr=180&hwr=... by Ajinkya1992 Path Finder in Deployment Architecture 01-08-2025 0 3	0	3
Splunk Universal Forwarder Version Update I need to upgrade the Splunk Universal forwarder version to all the existing installed windows 2016 and 2019 servers.... by Chirag812 Explorer in Deployment Architecture 01-08-2025 0 2	0	2
Splunk cluster hardware planning We are planning to upgrade our Splunk hardware. We currently have below(multisite indexer cluster with independant se... by jpillai Path Finder in Deployment Architecture 01-07-2025 0 3	0	3
Replacing Immutable Splunk Forwarders show as duplicates in Deployment Server We have a 5 node Splunk forwarder cluster to handle throughput of multiple servers in our datacenter. Currently our ... by aDevOpsPerson Engager in Deployment Architecture 01-03-2025 0 1	0	1
What are the requirements for a minimal Splunk installation on Ubuntu 20.04? We are creating an installation of one indexer, one search head, and one universal forwarder with syslog, and I wonde... by danielbb Motivator in Deployment Architecture 01-03-2025 0 7	0	7
On which version of Ubuntu should we install Splunk? We are about to create new VMs with the Ubuntu OS. Which version of Ubuntu is supported and recommended? by danielbb Motivator in Deployment Architecture 01-03-2025 0 6	0	6
How to secure the Splunk platform with SSL Hello,I have a distributed Splunk architecture with a single search head, two indexers, and management tier : License... by BRFZ Communicator in Deployment Architecture 01-02-2025 0 21	0	21
The deployment server did not find any clients Hello evereone I encountered an issue, as shown in the image. I can see two machines in the MC's forwarder dashboard,... by yin_guan Explorer in Deployment Architecture 12-31-2024 0 8	0	8
KV Store Configuration in Distributed Deployment Hello Splunk Community,I am working on the configuration of a distributed Splunk deployment, and I need clarification... by BRFZ Communicator in Deployment Architecture 12-24-2024 0 1	0	1
How to see result from CMD in Splunk ? Hi Everyone, I was create my own lab for learning to configure best practice for Windows. Then i create 1 Windows VM ... by zksvc Contributor in Deployment Architecture 12-23-2024 0 6	0	6
Splunk Intermediate Forwarder Setup Hello, I would like send two different index data one to indexer and other to Intermediate forwarder.How the configur... by RAVISHANKAR Explorer in Deployment Architecture 12-18-2024 0 1	0	1
SHCluster replication overwrites hostname in $SPLUNK_HOME/etc/system/local/inputs.conf Everytime we have to force replication on the SH nodes of a SH Cluster, the inputs.conf replicates and overwrites the... by SteveBowser Explorer in Deployment Architecture 12-18-2024 0 6	0	6
Is there a difference between HEC ingestion on-prem vs cloud? I'm under the impression that HEC ingestion directly to the indexers is supported natively on cloud. I wonder whether... by danielbb Motivator in Deployment Architecture 12-18-2024 0 1	0	1
Datamodel replication issue in SHC I have a SHC of 3 search heads. I changed some fields in data model of 1 sh. it is replicated on 2nd SH, but 3rd SH d... by Nawab Communicator in Deployment Architecture 12-17-2024 0 10	0	10
Indexer registering with Manager, assuming managers IP address I am developing a splunk setup using docker image and Podman. I am trying to setup 2 indexers along with an indexer ... by mike1002 Engager in Deployment Architecture 12-17-2024 0 2	0	2
How can we avoid the scaling issues with on-prem HEC subclusters? On Splunk cloud, we can receive HEC ingestion directly to the cloud whereas on-prem we install distinct subclusters f... by danielbb Motivator in Deployment Architecture 12-16-2024 0 9	0	9
problem in removing "Continue with external content?" warning i have a problem with the mention warning on my search head:(attached photo)i tried following the guide here:Configur... by dorHerbesman Path Finder in Deployment Architecture 12-16-2024 0 4	0	4
"Failed to validate SAML logout response receive I have configured Splunk with SAML (ADFS) but We are facing an issue during logout, with the following error message:... by hazem Path Finder in Deployment Architecture 12-15-2024 0 1	0	1
Otel multiline config Hi teamI'm trying to attach multiline config for all the pods in a namespace. Is there a way to achieve that? Adding ... by Vikashnat90 New Member in Deployment Architecture 12-11-2024 0 1	0	1
Splunk - Forwarder 2 Indexer - Self Signed Certificate Failure I've set up a dev 9.2 Splunk environment. And I'm trying to use a self-signed cert to secure forwarding. But every ti... by jefffredericks New Member in Deployment Architecture 12-10-2024 0 1	0	1
DB Connect: Heavy Forwarder Issue Hello, I have a Heavy Forwarder, and it was configured just to forward not index: [indexAndForward] index = false ... by AliMaher Path Finder in Deployment Architecture 12-09-2024 0 3	0	3
new install -9.3.2 - sec warning Hi There,hope u r doing good, thanks for reading. 1) A fresh install of Splunk Enterprise 9.3.2 showing this security... by inventsekar SplunkTrust in Deployment Architecture 12-06-2024 0 5	0	5
About installing Splunk Enterprise Security https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurityI installed Splunk Enterprise Securit... by masakazu Explorer in Deployment Architecture 12-05-2024 0 4	0	4
KV store on the newly built SH server not joining the KV cluster but part of SH cluster. We have new SH node which we are trying to add to the Search head cluster, updated the configs in shcluster config a... by HarishSamudrala Loves-to-Learn Lots in Deployment Architecture 12-05-2024 0 2	0	2