Deployment Architecture

Community Activity

Max warm settings exceeded, but cold is still empty I am looking through my indexes, and I see that my busiest one is not responding at all how I thought I had it config... by oliverj Communicator in Deployment Architecture 03-13-2019 0 1	0	1
How to pull out blocked connections from illumio within our Unix/Linux environment? If I log into the Linux system in question and go to the log area /var/log/illumio-pce/agent_traffic.log type grep bl... by jshekell Explorer in Deployment Architecture 03-13-2019 0 5	0	5
Running the same search, why are different results showing up? If I run the same search using the same time window I get sometimes different results. I have added \| eval bkt=_bkt... by szymonledzinski New Member in Deployment Architecture 03-13-2019 0 1	0	1
Cluster search head down (crashes) splunk 7.1.0 good morning Our SH cluster is going back several times and we do not know the cause. someone could give me some ... by aecruzp Path Finder in Deployment Architecture 03-12-2019 0 2	0	2
How to properly upgrade a multi-site indexer cluster A customer had been trying to upgrade our Test Splunk multisite environment from 6.3 to 6.5.1 but was unable to progr... by kgrigsby_splunk Splunk Employee in Deployment Architecture 03-12-2019 0 8	0	8
What is Splunk deployment server version compatibility with deployment client? Would Splunk deployment servers have compatibility issue with deployment clients that are on earlier version? by keio_splunk Splunk Employee in Deployment Architecture 03-12-2019 0 1	0	1
How can I increase the universal forwarder buffer size to insure logs are not lost when site becomes isolated? The network connectivity at one of my sites drops on occasions. So, I was reading best practice is to configure a sys... by nickcc Engager in Deployment Architecture 03-08-2019 0 1	0	1
Sending cooked but unparsed data from Heavy Forwarder Hi Splunkers, We are ingesting data using the Splunk TA for AWS, which is installed on a heavy forwarder. While this... by nicolas_perreau Explorer in Deployment Architecture 03-08-2019 0 4	0	4
Can you help me with an Issue building a Splunk cluster? I manage a couple of small Splunk clusters, and for the 1st time, I need to build one form scratch. I am testing in o... by a238574 Path Finder in Deployment Architecture 03-07-2019 0 4	0	4
Why are some of the Linux timestamps not parsing? I tried importing these on a different non production system, and some new information came to light. This post has n... by oliverj Communicator in Deployment Architecture 03-07-2019 1 11	1	11
Search head - Search peer communication direction in distributed enviroment Hi all, I have a simple question: In a distributed environment (without SH cluster), what happens when I do a distri... by tdubicz Engager in Deployment Architecture 03-07-2019 0 2	0	2
Splunk alert for server downtime , if downtime exceeds more than 15 minutes I have list of windows server in the inputlookup, if server downtime exceeds more than 15 minutes for any of the serv... by saravanafd Explorer in Deployment Architecture 03-06-2019 0 3	0	3
Does HEC have to run on 8088? Could it also run on 9997 port? We are planning to implement HEC on our Splunk setup, we are looking to see if HEC works on 9997 or should it only us... by Splunker2911 Loves-to-Learn in Deployment Architecture 03-05-2019 0 3	0	3
How do I create indexes.conf (new way) to not use colddb? I'm trying to set up some new indexes, and then best-practices way, and I'm a little confused on how to accomplish wh... by joesrepsolc Communicator in Deployment Architecture 03-05-2019 0 2	0	2
Retention Policy - FrozenDB Data compress and encrypt Hello Community, I'm relatively new to Splunk and now I'm struggling with a bigger challenge for me. The following sc... by hiph151 Explorer in Deployment Architecture 03-05-2019 0 0	0	0
Large number of Forwarders and Deployment server Does anyone have experience with using a large number of universal forwarders (Around 6000) and the deployment server... by rmcdougal Path Finder in Deployment Architecture 03-04-2019 0 6	0	6
Retiring indexers I have an older cluster that is currently aging out. The peer group consists of three indexers which need to be drop... by BrianAbbott Explorer in Deployment Architecture 03-04-2019 1 5	1	5
New Indexer Failing due to Cert Password, what is the default password? I have a new indexer. It's in the cluster, replicated and appears fine. We're using the default splunk generated cert... by splunk219783 Path Finder in Deployment Architecture 03-04-2019 0 3	0	3
Differentiation of indices between nodes What I need to deploy clustered indexes on different nodes. I want to get 3 clusters of 2 nodes each with the ability... by Semen New Member in Deployment Architecture 03-03-2019 0 7	0	7
Can you help me with a Splunk Backup Question? I am running Splunk Enterprise version 6.6.2. I have four Splunk servers in a non-clustered environment: One search h... by johann2017 Explorer in Deployment Architecture 03-01-2019 0 3	0	3
Is it normal for an indexer cluster master to connect to peers on odd ports? I was troubleshooting why peers show as "Pending" often in the cluster master web UI. In troubleshooting I ran 'ss \|l... by tkw03 Communicator in Deployment Architecture 03-01-2019 0 2	0	2
Can I control where the primary copy resides in a multisite indexer cluster setup? Question: I have SiteA and SiteB and plan to keep 2 copies, ie RF=2 I would like to use this setup where forwarders... by jiaqya Builder in Deployment Architecture 03-01-2019 0 10	0	10
What are the impacts of the cluster master being down for some period? Hi ream, We would like to know what would be the impact on the Indexer Clustering tier if our Cluster Master (AWS EC... by jaracan Communicator in Deployment Architecture 02-28-2019 0 2	0	2
Looking for a REST status OK for load balancer healthcheck I'm looking for a basic heartbeat or healthcheck for search head status, in order to put behind a load balancer. This... by davebo1896 Communicator in Deployment Architecture 02-28-2019 2 8	2	8
Does the forwarder send data in chunks of 64 KBs? Does the forwarder send data in chunks of 64 KBs? Does it introduce issues with event breaking? Is there a way to cha... by ddrillic Ultra Champion in Deployment Architecture 02-28-2019 0 3	0	3