Deployment Architecture

Community Activity

LDAP bind password left in clear text on deployer What would be the proper way to push an authentication.conf from the deployer and have the bind password not left in ... by nyajoefit22 Loves-to-Learn Lots in Deployment Architecture 10-25-2024 0 3	0	3
Impossible to remove search head cluster I configured a search head cluster and configured a captain and added the searchheads to the indexer cluster.I now wa... by d123r432k Engager in Deployment Architecture 10-25-2024 0 4	0	4
Unable to fetch logs from Index in Search Head Hello,I have configured an index inside an indexer and when i try to fetch data from that index in search head not ge... by RAVISHANKAR Explorer in Deployment Architecture 10-25-2024 0 7	0	7
Props.Conf - By-Pass Hello ,i have a common log file which same name in both production and stage with different name for sourcetype.As i ... by RAVISHANKAR Explorer in Deployment Architecture 10-25-2024 0 5	0	5
OLD Indexers still give errors on SH-CLUSTER restart Hi there.This morning i did a SHC restart, and found something very strange from SHC Members,WARN DistributedPeer [1... by verbal_666 Builder in Deployment Architecture 10-24-2024 0 3	0	3
Adding a new search head to an existing Search Head Cluster, if I want to add the same users from LDAP, can I just copy authorize.conf & authorization.conf? I am adding a new search head to the existing search head cluster. I want to add the same users to the new search hea... by rcreddy06 Path Finder in Deployment Architecture 10-23-2024 2 3	2	3
Splunk indexer hot bucket roll to smartstore I am planning on upgrading our Splunk infrastructure which requires our Splunk indexers to go offline for few minutes... by Richy_s Path Finder in Deployment Architecture 10-22-2024 0 4	0	4
How to configure universal forwarder to send logs to Logstash for DB Connect? I'm trying to configuring Splunk Universal Forwarder to send logs to Logstash.I only have access to the Universal For... by pete00 Loves-to-Learn Everything in Deployment Architecture 10-21-2024 0 13	0	13
Splunk Distributed Deployment: Best Practisce Hello,I am writing to ask from which point regarding the EPS OR Daily ingested GB/day and the number of users simulta... by AliMaher Path Finder in Deployment Architecture 10-20-2024 0 5	0	5
Deployment Options Had some basic queries - Can splunk be deployed as a CNF on Redhat OpenShift Cloud Platform ??Also is the same deploy... by virgupta New Member in Deployment Architecture 10-18-2024 0 1	0	1
How to monitor Indexer rolling start from Internal logs Hi all, I am trying to build a query to monitor my indexer rolling restart I would like to know how much time it has ... by deepthi5 Path Finder in Deployment Architecture 10-16-2024 0 1	0	1
How to replicate or have a copy of index in two different Splunk Indexer located in different place. Currently I am having a Splunk Indexer with multiple Indexes and a Search Head.I would like to have one or two indexe... by RAVISHANKAR Explorer in Deployment Architecture 10-15-2024 0 2	0	2
streamfwd app error in /var/log/splunk/streamfwd.log Hello! I am trying to get the streamfwd app to capture traffic on an interface located on my virtual machine.Does thi... by johnncennaa Engager in Deployment Architecture 10-14-2024 1 8	1	8
Search head's authentication credentials rejected by peer Hi,I encountered an issue where my indexer disconnected from the search head (SH), and similarly, the SH and indexer... by BRFZ Communicator in Deployment Architecture 10-14-2024 0 1	0	1
Splunk hight monitoring memory vs VM low memory used Hi splunkers ! I got a question about memory. In my splunk monitoring console, I get approx 90% of memory used by sp... by _olivier_ Path Finder in Deployment Architecture 10-14-2024 0 2	0	2
Index Volume Location On Search Heads still a total newb here so please be gentle, on Microsoft Window 2019 servers we have an Index cluster and here's how... by Gregski11 Contributor in Deployment Architecture 10-11-2024 0 3	0	3
Splunk-Operator Indexer Cluster Access Issues I am testing out the Splunk Operator Helm chart to deploy a C3 architecture Splunk instance. At the moment everything... by ZimmermanC1 Explorer in Deployment Architecture 10-08-2024 0 2	0	2
Passing multiple tokens to another dashboard using dashboard studio Hi All,I have a dashboard built using dashboard studio. I want to pass multiple tokens to another dashboard on click ... by Poojitha Communicator in Deployment Architecture 10-08-2024 0 1	0	1
Creating React app on Splunk instance on macOS doesn't work Hello,I am following this tutorial to create a Splunk app using React on macOS Sonoma: https://splunkui.splunk.com/To... by DSS3113 Engager in Deployment Architecture 10-07-2024 0 1	0	1
Where to perform field extraction in Splunk cluster Hi, I am new to Splunk. I have built a splunk cluster (3 indexers, 1 master(also the license master), 1 search head).... by neltonk Path Finder in Deployment Architecture 10-04-2024 1 7	1	7
What happens if maxTotalDataSizeMB is not declared? I understand that maxTotalDataSizeMB takes precedence over frozenTimePeriodInSecs.What happens if frozenTimePeriodInS... by jessieb_83 Path Finder in Deployment Architecture 10-03-2024 0 5	0	5
Error when running Splunk -9.0.2-17e00c557dc1-linux-2.6-amd64.deb Hi Community, Has anyone had a problem after installing the new Splunk 9.0.2.1? I had a problem after I finished dow... by dgoutama Loves-to-Learn in Deployment Architecture 10-02-2024 0 6	0	6
Forwarder Management troubleshooting client errors- Where can I find the client errors? In forwarder management I get a message stating there are 6 clients with "DEPLOYMENT ERRORS" but cannot find the issu... by dspyros Engager in Deployment Architecture 10-01-2024 2 8	2	8
Migration from Standalone to indexer cluster (2 indexers + 1 SH) Hi fellows, It's time to migrate our good old Standalone Splunk Enterprise to 'Small Enterprise deployment'.I read th... by norbertt911 Communicator in Deployment Architecture 09-30-2024 0 12	0	12
Universal Forwarder upgrade frequency best practices. Hi,I'm looking for advise how often should I upgrade Splunk Universal Forwarder - what is the best practice for this.... by PiotrAp Path Finder in Deployment Architecture 09-30-2024 0 8	0	8