Deployment Architecture

Community Activity

Is ODA X5 Splunk compatible with Oracle Linux OS? I have a ODA X5, that is going to be erased and formatted. Can this system be used for a Splunk deployment? Is the ap... by ervargas New Member in Deployment Architecture 09-04-2018 0 4	0	4
How to manage the buckets in volumes configured for indexes? I have a question about managing the buckets in my volumes configured for indexes. Below are my current configurati... by keithyap Path Finder in Deployment Architecture 09-02-2018 0 4	0	4
Why is the indexer cluster master being marked as down consistently? We have the following alert - \| rest splunk_server=local /services/search/distributed/peers/ \| where status!="Up" ... by ddrillic Ultra Champion in Deployment Architecture 09-02-2018 0 3	0	3
Can you differentiate between various Splunk servers using different colors? We are installing a larger Splunk setup. It has a lot of index servers. Search server. Jobs/deploy server Test server... by lakromani Builder in Deployment Architecture 09-02-2018 0 4	0	4
Histogram and bucket size Hi I have some proprietary log data that gives 3 different response times for each event. These are extracted into Ti... by uthornander_spl Splunk Employee in Deployment Architecture 08-31-2018 0 2	0	2
Getting the warning "Splunk has found # orphaned searches owned by # unique disabled users", but no results displayed We are running Splunk Enterprise v. 7.0.4 on our search head cluster. Recently we have started to get the following w... by mlevsh Builder in Deployment Architecture 08-31-2018 0 3	0	3
How do I measure the amount of data in cold buckets? I am using the following search ,and it seems to works with hot buckets but not when changed to cold. I need to have ... by donmeyer New Member in Deployment Architecture 08-31-2018 0 0	0	0
How do you retroactively make an unmanaged app a managed app on the deployment server? Hello everyone, I have a deployment server that manages most of our Splunk apps, but when everything was setup, some... by JK42 Explorer in Deployment Architecture 08-31-2018 0 1	0	1
How to delete local changes to knowledge objects in a search head cluster? Hey there! I hope someone can give me hints on working with knowledge objects in a distributed environment. At the m... by Skorfulose Explorer in Deployment Architecture 08-31-2018 3 5	3	5
Indexer Cluster Error: site_replication_factor={ origin:1, total:2 } is less than replication_factor=3. I have a multisite cluster with 2 sites and 2 indexers per site. I'm receiving the following error on the cluster mas... by harrymclaren Explorer in Deployment Architecture 08-31-2018 3 3	3	3
Page not found on clicking universal forwarder in splunk cloud 404 Not Found Return to Splunk home page Page not found! View more information about your request (request ID = 5b8... by vmatti New Member in Deployment Architecture 08-30-2018 0 2	0	2
netflow Analytics for splunk in search head cluster the Netflow Analytics for splunk app does not seem to be replicating config accross the SHC. I have to go to each SH... by coreyf311 Path Finder in Deployment Architecture 08-30-2018 0 3	0	3
Would it cause problems to use a Search Head Cluster with only two members? Hi at all, for a customer, I need to replicate knowledge objects between two Search Heads and high availability. The ... by gcusello SplunkTrust in Deployment Architecture 08-29-2018 0 5	0	5
How to audit user modifications to search head cluster? I need to create a query to reveal who changed which objects on the search head cluster when (excluding modifications... by awmorris Path Finder in Deployment Architecture 08-29-2018 0 1	0	1
How do I estimate retention needs for a new Splunk Cloud deployment? Hi. We are looking to estimate retention needs for a new Splunk Cloud deployment. I'm looking at using the following ... by jhigginsmq Path Finder in Deployment Architecture 08-29-2018 0 1	0	1
Search Head not indexing _internal and summarization errors Our Splunk Search Head is no longer indexing _internal logs (splunkd.log etc), the searches still run but are really ... by mmoermans Path Finder in Deployment Architecture 08-29-2018 0 6	0	6
Are search head field extractions superficial? Newbie here. So, I have learned that there are two types of field extractions: those that happen during the input p... by morethanyell Builder in Deployment Architecture 08-29-2018 0 4	0	4
Is there a "What If" command for applying the cluster bundle to let you know whether it will require a restart versus a reload? Does anyone know if there is a sort of "what if" option for applying the cluster bundle to let you know whether it wi... by maciep Champion in Deployment Architecture 08-29-2018 5 10	5	10
Index Processor: The index processor has paused data flow. Too many tsidx files in.... Hello, I have recently inherited a Splunk Enterprise (v6.6) instance with some serious issues. The architecture is a... by alex387 New Member in Deployment Architecture 08-28-2018 0 2	0	2
unable to distribute to peer - unable to get auth token - READ TIMEOUT We Just migrated two SH Vms to a new data center. Now we are having intermitten timeouts to where the search heads ca... by bcyates Communicator in Deployment Architecture 08-28-2018 0 3	0	3
Why do I get this "editTracker failed" error when trying to connect master instance (enterprise) and slave instance (trial)? So I tried to set up a new Splunk instance (currently trial version) and I want that instance to be a splunk slave fr... by DanielUhlmann New Member in Deployment Architecture 08-28-2018 0 11	0	11
default_namespace in an LDAP, multi-tenant, SHC We have different groups in our company. Each group gets an app, say acme_search. There are roles associated with the... by twinspop Influencer in Deployment Architecture 08-27-2018 0 7	0	7
What is the easiest method of starting a new Splunk environment? What is the easiest method of starting a new Splunk environment? I was suggested to create a virtual machine with my ... by GIPO29 Path Finder in Deployment Architecture 08-26-2018 0 11	0	11
Is there an easy way to delete namespace data in a clustered environment? Is it possible to delete the contents of a namespace in a clustered environment from the search pipeline or a setting... by responsys_cm Builder in Deployment Architecture 08-24-2018 0 2	0	2
Are there any best practices for Upgrading Splunk server to RHEL 7.5? We are planning to upgrade the VM server to RHEL 7.5 with splunk distributed deployment installed in them. Do we have... by teddyidc1101 Communicator in Deployment Architecture 08-24-2018 0 3	0	3