Deployment Architecture

Community Activity

Sending cooked but unparsed data from Heavy Forwarder Hi Splunkers, We are ingesting data using the Splunk TA for AWS, which is installed on a heavy forwarder. While this... by nicolas_perreau Explorer in Deployment Architecture 03-08-2019 0 4	0	4
Can you help me with an Issue building a Splunk cluster? I manage a couple of small Splunk clusters, and for the 1st time, I need to build one form scratch. I am testing in o... by a238574 Path Finder in Deployment Architecture 03-07-2019 0 4	0	4
Why are some of the Linux timestamps not parsing? I tried importing these on a different non production system, and some new information came to light. This post has n... by oliverj Communicator in Deployment Architecture 03-07-2019 1 11	1	11
Search head - Search peer communication direction in distributed enviroment Hi all, I have a simple question: In a distributed environment (without SH cluster), what happens when I do a distri... by tdubicz Engager in Deployment Architecture 03-07-2019 0 2	0	2
Splunk alert for server downtime , if downtime exceeds more than 15 minutes I have list of windows server in the inputlookup, if server downtime exceeds more than 15 minutes for any of the serv... by saravanafd Explorer in Deployment Architecture 03-06-2019 0 3	0	3
Does HEC have to run on 8088? Could it also run on 9997 port? We are planning to implement HEC on our Splunk setup, we are looking to see if HEC works on 9997 or should it only us... by Splunker2911 Loves-to-Learn in Deployment Architecture 03-05-2019 0 3	0	3
How do I create indexes.conf (new way) to not use colddb? I'm trying to set up some new indexes, and then best-practices way, and I'm a little confused on how to accomplish wh... by joesrepsolc Communicator in Deployment Architecture 03-05-2019 0 2	0	2
Retention Policy - FrozenDB Data compress and encrypt Hello Community, I'm relatively new to Splunk and now I'm struggling with a bigger challenge for me. The following sc... by hiph151 Explorer in Deployment Architecture 03-05-2019 0 0	0	0
Large number of Forwarders and Deployment server Does anyone have experience with using a large number of universal forwarders (Around 6000) and the deployment server... by rmcdougal Path Finder in Deployment Architecture 03-04-2019 0 6	0	6
Retiring indexers I have an older cluster that is currently aging out. The peer group consists of three indexers which need to be drop... by BrianAbbott Explorer in Deployment Architecture 03-04-2019 1 5	1	5
New Indexer Failing due to Cert Password, what is the default password? I have a new indexer. It's in the cluster, replicated and appears fine. We're using the default splunk generated cert... by splunk219783 Path Finder in Deployment Architecture 03-04-2019 0 3	0	3
Differentiation of indices between nodes What I need to deploy clustered indexes on different nodes. I want to get 3 clusters of 2 nodes each with the ability... by Semen New Member in Deployment Architecture 03-03-2019 0 7	0	7
Can you help me with a Splunk Backup Question? I am running Splunk Enterprise version 6.6.2. I have four Splunk servers in a non-clustered environment: One search h... by johann2017 Explorer in Deployment Architecture 03-01-2019 0 3	0	3
Is it normal for an indexer cluster master to connect to peers on odd ports? I was troubleshooting why peers show as "Pending" often in the cluster master web UI. In troubleshooting I ran 'ss \|l... by tkw03 Communicator in Deployment Architecture 03-01-2019 0 2	0	2
Can I control where the primary copy resides in a multisite indexer cluster setup? Question: I have SiteA and SiteB and plan to keep 2 copies, ie RF=2 I would like to use this setup where forwarders... by jiaqya Builder in Deployment Architecture 03-01-2019 0 10	0	10
What are the impacts of the cluster master being down for some period? Hi ream, We would like to know what would be the impact on the Indexer Clustering tier if our Cluster Master (AWS EC... by jaracan Communicator in Deployment Architecture 02-28-2019 0 2	0	2
Looking for a REST status OK for load balancer healthcheck I'm looking for a basic heartbeat or healthcheck for search head status, in order to put behind a load balancer. This... by davebo1896 Communicator in Deployment Architecture 02-28-2019 2 8	2	8
Does the forwarder send data in chunks of 64 KBs? Does the forwarder send data in chunks of 64 KBs? Does it introduce issues with event breaking? Is there a way to cha... by ddrillic Ultra Champion in Deployment Architecture 02-28-2019 0 3	0	3
known issues for the new version on license-handling 7.2.2 Hello , We are planning to upgrade Splunk License Server from 7.2.0 to 7.2.2. Can anyone please help me out with th... by impsk New Member in Deployment Architecture 02-27-2019 0 1	0	1
Can you help us scale up a distributed search from one search head + one indexer to one SH + two indexers? The plan is to scale up a current distributed search framework — from one search head (SH) + one indexer to one SH + ... by xindeNokia Path Finder in Deployment Architecture 02-27-2019 0 1	0	1
Cluster - Can you symlink .../system/local/ to .../master-apps/_cluster/local/ ? When you use the API to create index stanzas on a master, it places it in .../system/local/. API endpoint: /services... by thisissplunk Builder in Deployment Architecture 02-27-2019 0 1	0	1
in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head? I have Splunk distributed 7.2.1 (1 dedicated Search Head with multilple non clustered indexers) I am wondering if t... by arlakathena Explorer in Deployment Architecture 02-26-2019 1 8	1	8
How to update a deployment server deployment-apps? I want to update an app that gets pushed out from the deployment server to my forwarders, but i have made changes in ... by JScordo Path Finder in Deployment Architecture 02-26-2019 2 4	2	4
Splunk Universal Forwarder on NAS Server Is it feasible to install a Splunk Universal Forwarder on NAS Server to forward logs that exist there? by tcalhoon Explorer in Deployment Architecture 02-26-2019 0 3	0	3
Copy index I'm looking for a clean way to copy an index or duplicate a data stream withouth having to index it twice. We have a... by splunkuzleuven Loves-to-Learn Lots in Deployment Architecture 02-26-2019 0 3	0	3