Deployment Architecture

Discussions

Thread Info

Stream forwarder only works when running as root

I need to run Splunk Stream on some universal forwarders to capture data from a set of servers. The only way I've bee...

by Engager in

Clarification on Splunk App DSDL max_inputs limit

Hi experts, I am in early experiment journey with Splunk App for DSDL (aka DLTK) to pull in some events into Jupyte...

by Explorer in

index problem search

the index is appearing inside the indexer cluster dashboard inside cluster master but when i try to search it using S...

by Explorer in

Deployment client phoning to Management console instead of HF acting as DS

I have a deployment, where 2 HF's are acting as DS. and they are both connected to MC for licensing at port 8089. ...

by Communicator in

index creation from HF

Hello members, I have clustered environment and i create index on HF and data inputs for receive syslog, I crea...

by Explorer in

Search Cluster Overwriting etc/system/local/inputs.conf

Situation. Search Cluster - 9.2.2 5 nodes running Enterprise Security version 7.3.2 I'm in the process of addin...

by Path Finder in

SAML issue "Data could not be written: /nobody/system/authentication/userToRoleMap_SAML:"

Good afternoon everyone! Helping a client setup Splunk SAML for the first time. We have confirmed that the SAM...

by Path Finder in

Recommendations for OS partitions, mount points and RAID configuration for linux servers

planning to deploy a splunk architecture with one SH and indexer cluster with 100GB/day data ingestion. Are there any...

by Observer in

What it takes to replace SAS with Splunk on IBM Z Performance and Capacity Analytics

We have a customer who does get IT mainframe insights today via CA SAS/MICS, a costly platform. They are seeking a so...

by New Member in

Notable events to be stored in Splunk locally and also be sent to another platform

Hi, Good day! Just wanted to check your insights or any reference that you can share.We have Clustered Multisite Sp...

by Communicator in

BundleDataProcessor - File length is greater than 260

Hi! We deployed 2 new servers on Linux and cteated from them SHcluster.Captain:dynamic_captain : 1elected_captain :...

by Loves-to-Learn in

Indexes.conf config stuck

In Indexes.conf from the CM, I tried to set thawedHomePath to a volume, which I have since learned does not work. I...

by Path Finder in

Forwarding events to an indexer cluster using an AWS ELB

Hey all, We have many different forwarders installed on different hosts and we are migrating to a cluster of index...

by Explorer in

Remove missing/duplicate forwarders from forwarder managment

This sounds like an "asked and answered" question, but my searches didn't come up with a satisfactory answer. How ...

by New Member in

Search Head cluster : Multi-Cloud Search

I've been out of touch with Core Splunk for sometime, so just checking if there are options for below requirement O...

by Super Champion in

The percentage of non high priority searches lagged (48%) over the last 24 hours is very high and exceeded the yellow th

Hi all, How can this be fixed? Thanks for your help on this,

by Loves-to-Learn Lots in

Expanding my splunk architecture

Currently, I have a single Splunk server that is performing all the necessary functions. However, I would like to exp...

by Path Finder in

to provide the list of P1C alerts for JMET cluster from Splunk

There is a request to provide the list of P1C alerts for JMET cluster from Splunkwe have provided the following quer...

by Loves-to-Learn Lots in

New inputs.conf Settings Not Applied After Pushing Configurations from Deployment Server (Splunk 9.2.1)

Hi Splunk community, I'm facing an issue with my Splunk deployment server, running on version 9.2.1 (splunk-9.2...

by Explorer in

app/launcher/home requires xml -- won't launch json dashboard

The classic dashboard format was xml; the new Dashboard Studio format is json. Our app/launcher/home is failing to lo...

by New Member in

Splunk Heavy Forwarder vs Universal Forwarder for large splunk instance

Hello Everyone, looking for a little guidance on our Splunk deployment for a system. Currently, we have a few diffe...

by Explorer in

Splunk bandwidth requirements

Dear All,I would like to introduced the DR Site along with active log ingestion (SH cluster + Indexers cluster ). i...

by Explorer in

Why this error on search head cluster after updating Splunk_TA_Windows?

I recently updated Splunk_TA_Windows and am seeing this error on my search head cluster:[Indexers] Could not load loo...

by Path Finder in

Why does the Monitoring Console not update with new indexer information?

I've replaced 2 or my 4 indexers in the cluster on an AWS deployment. The Indexer Cluster Status shows the right list...

by Explorer in

Can you still search logs on an indexer that is turned into a heavy forwarder

We have a legacy all-in-one Splunk server. We have built out a new distributed environment that has an indexer cluste...

by Builder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Stream forwarder only works when running as root

Clarification on Splunk App DSDL max_inputs limit

index problem search

Deployment client phoning to Management console instead of HF acting as DS

index creation from HF

Search Cluster Overwriting etc/system/local/inputs.conf

SAML issue "Data could not be written: /nobody/system/authentication/userToRoleMap_SAML:"

Recommendations for OS partitions, mount points and RAID configuration for linux servers

What it takes to replace SAS with Splunk on IBM Z Performance and Capacity Analytics

Notable events to be stored in Splunk locally and also be sent to another platform

BundleDataProcessor - File length is greater than 260

Indexes.conf config stuck

Forwarding events to an indexer cluster using an AWS ELB

Remove missing/duplicate forwarders from forwarder managment

Search Head cluster : Multi-Cloud Search

The percentage of non high priority searches lagged (48%) over the last 24 hours is very high and exceeded the yellow th

Expanding my splunk architecture

to provide the list of P1C alerts for JMET cluster from Splunk

New inputs.conf Settings Not Applied After Pushing Configurations from Deployment Server (Splunk 9.2.1)

app/launcher/home requires xml -- won't launch json dashboard

Splunk Heavy Forwarder vs Universal Forwarder for large splunk instance

Splunk bandwidth requirements

Why this error on search head cluster after updating Splunk_TA_Windows?

Why does the Monitoring Console not update with new indexer information?

Can you still search logs on an indexer that is turned into a heavy forwarder

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Splunk Observability for AI

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Offline Logging and oberservability - on permises

v0.116.0 upgrade for EKS cluster gives webhook err...

My servers class Agent allways in Pending status

Deployment Architecture

Are you a member of the Splunk Community?

Discussions