Deployment Architecture

Community Activity

Orphaned Searches: how do you disable the orphan notifications on search head members? hi, We have quite a large amount of users and hence leavers/movers are common. We are aware of how to fix the orphan... by koshyk Super Champion in Deployment Architecture 10-31-2018 0 2	0	2
Can A Single Master Cluster Node support multiple clusters? Let's say I have two groups of two indexers, each group in its own cluster. Can I use a single master cluster node t... by thomas_porter Explorer in Deployment Architecture 10-31-2018 0 4	0	4
How to add custom filed to input.config,Hoe to add custom field to input.config Hello I have 3 servers (one for each env) , each of the server forward data to the same index. I want to create a se... by moradato Engager in Deployment Architecture 10-31-2018 0 1	0	1
Merge Indexer Cluster and Search Head Cluster after a Split Brain How can a search head and an indexer cluster be merged after the cluster has been run intentionally in a split brai... by FritzWittwer_ol Contributor in Deployment Architecture 10-31-2018 0 1	0	1
how to create bucket over a period of 3 days? Hello Folks, We're trying to set up an alert for user contacting malware websites constantly. For eg user A attempts... by utsav45 Explorer in Deployment Architecture 10-30-2018 0 4	0	4
How can I automate the data on-boarding process? I have Splunk Universal Forwarder installed on RHEL. I have hundreds of stanzas manually written in $SPLUNKHOME/etc/a... by dharveynswccd Path Finder in Deployment Architecture 10-30-2018 1 0	1	0
Separate UF buffers for tcpout groups, is this possible? Hi all, I have 2 tcpout groups on my servers sending data to 2 distinct sets of indexers. A number of servers recent... by chris24747 Explorer in Deployment Architecture 10-30-2018 0 0	0	0
clustering.pyo file is created in Non-Cluster environment Issue description: I did not change setting in Splunk, but the following files were generated. /opt/splunk/lib/pytho... by dubeysantosh Explorer in Deployment Architecture 10-30-2018 0 1	0	1
SHC bundle push is not working local folder does not get updated Using the Deployer to deploy Apps to my Search Heads in a SHC setup. I had been trying to push out a new App, Phantom... by sdubey_splunk Splunk Employee in Deployment Architecture 10-30-2018 0 1	0	1
Cluster Master have SF/RF not meet due to a lot of bucket got status 'bucket hasn't rolled yet' This message may go away if waiting for longer time. However, I don't want to wait and any command to roll all the bu... by daniel_splunk Splunk Employee in Deployment Architecture 10-29-2018 0 4	0	4
Issues with data rebalance from cluster master When I use the Data rebalance option from the Cluster master, it shows that it is complete within 10-20 mins Do not ... by athorat Communicator in Deployment Architecture 10-27-2018 0 5	0	5
Send log in another index based on a tag Hello, I am using docker and I send all containers logs using logspout into a TCP input on Splunk. Before trying to ... by lmilcent New Member in Deployment Architecture 10-26-2018 0 0	0	0
How does the frozen bucket work exactly? All, So I have frozenTimePeriodInSecs=10368000 in my indexes.conf. That is 120 days old. Yet i have data going back... by daniel333 Builder in Deployment Architecture 10-25-2018 0 3	0	3
How do I access the control panel on admin role on a Splunk search head cluster? hi if any one can help — i lost access to the control panel on admin role on a Splunk search head cluster. I check... by anilsharmahk New Member in Deployment Architecture 10-25-2018 0 5	0	5
Can the disk size be different on the servers in the same Indexer cluster? hi All, We have indexer cluster with 6 servers and out of these 4 servers has more than 90% space utilization. Due t... by mallempatisreed Explorer in Deployment Architecture 10-25-2018 0 1	0	1
Values for cluster_status when running splunk show cluster-bundle-status I'm trying to automate some of our Splunk processes, and I need to know what the possible set of values are that can ... by jacobappleton Explorer in Deployment Architecture 10-25-2018 0 1	0	1
Multiple same TA on a single universal forwarder Hi All, I have a question on how this should be approached. Stage: There are multiple A type servers where wmi.conf... by MikaJustasACN Path Finder in Deployment Architecture 10-25-2018 0 2	0	2
I need ZIP packed of splunk universal forward agent 7.2.0 Hello! Could you help me to find zip package of UF 7.2.0??? Where Can I download it? by atyshke1 Path Finder in Deployment Architecture 10-24-2018 0 6	0	6
Structured data header extraction - WARN CsvLineBreaker - Parser warning: Encountered unescaped quotation mark in field I Recently came across an issue where the following warning message was spamming my forwarder's splunkd.log for a str... by gcato Contributor in Deployment Architecture 10-24-2018 0 1	0	1
Load balancer in front of Deployment Servers We are experiencing connection errors when placing a load balancer in front of our deployment servers. These are the ... by bsanch2 Path Finder in Deployment Architecture 10-24-2018 0 3	0	3
Is a dead SHC member expected to cause a batch of missed scheduled searches? At oh:dark:30 yesterday one of my search heads took a dirt nap. 1 in a 4 member cluster. Thread - ReplicationDataRec... by twinspop Influencer in Deployment Architecture 10-23-2018 0 7	0	7
How to revert "splunk apply shcluster-bundle" changes from deployer and what is master node for SH Cluster? Urgent Issue We have a clustered environment and it seems that some changes were recently deployed but that deleted ... by kamal_jagga Contributor in Deployment Architecture 10-23-2018 0 5	0	5
Log forwarding using the splunk Universal forwarder to splunk clound HI All, I am new to the splunk trying to setup the log deliver to the splunk cloud. I am able to successfully instal... by hemuvootla2 Engager in Deployment Architecture 10-23-2018 0 2	0	2
WMI:memory - Memory Utilization Trend Trying to pull the information of Total Memory allocated to the Windows server(VM) and Utilization. However when i se... by motupaul New Member in Deployment Architecture 10-23-2018 0 0	0	0
Splunk service on search heads going inactive after rolling restart I made a splunk.service file inside /etc/systemd/system so I could manage splunk like a service. Here is what i wrote... by agentsofshield Path Finder in Deployment Architecture 10-23-2018 1 1	1	1