Deployment Architecture

Community Activity

REST API trigger limits for search head Hey guys, What are the REST API trigger limits for search head per 1 minute e.g.? I'm gonna call my search head from... by highsplunker Contributor in Deployment Architecture 09-23-2018 0 1	0	1
Uncooked Data Containing hostname I am sending uncoooked data but the hostname the other end are seeing is the Heavy Forwarder. Is there anyway of se... by lukessi Path Finder in Deployment Architecture 09-21-2018 0 2	0	2
Is there a limitation on the amount of data an outlier can process? Is there a limitation on the amount of data an outlier can process? I have several examples processing around 3K row... by Jthreadgill Explorer in Deployment Architecture 09-21-2018 0 0	0	0
Only splunkd.logs for index=_internal is visible for my AWS UF server Hi, I have around 1k number of hosts setup in AWS containers where I don't have access to any forwarders. All my for... by rchittip Path Finder in Deployment Architecture 09-20-2018 0 0	0	0
How search head knows which site primaries copies to search when search affinity is disabled in multisite clustering When search affinity is disabled, search head can search across all indexers across multiple sites. But primaries on ... by ankithreddy777 Contributor in Deployment Architecture 09-20-2018 0 0	0	0
Why does only specific data on my UF not being sent to my Indexers? Hi, here is my situation: My Splunk environment is all Linux which exists of 3 indexers, 2 search heads and 2 log col... by dharveynswccd Path Finder in Deployment Architecture 09-20-2018 0 0	0	0
What is Search Head? Can it be seen in the UI? In the Splunk Architeture, it is known that Splunk has major 3 components. 1. Forwarder - Instance installed at the l... by gokikrishnan198 New Member in Deployment Architecture 09-20-2018 0 2	0	2
Adding new indexer to indexer cluster If a new indexer is added to the cluster. Do we need to manually push the cluster-bundle from master to indexers OR C... by ankithreddy777 Contributor in Deployment Architecture 09-19-2018 0 2	0	2
Why am I getting error "Cannot perform action "POST" without a target name to act on" trying to add a server to a serverclass via REST API? Hi, I'm trying to add a server to a serverclass using the REST API, but getting an error. Can someone help me? cur... by a212830 Champion in Deployment Architecture 09-18-2018 0 5	0	5
Can you help me with Splunk password encryption for server.conf? Hi, I have a server.conf file under system/local directory which has following stanza [general] pass4SymmKey = $1$xx... by ankithreddy777 Contributor in Deployment Architecture 09-18-2018 0 0	0	0
Will the below properties help us reach the following log retention goals? Hello, I went through a few forum posts and Splunk documentations on retention settings but it's still not 100% cle... by srikarmohan Observer in Deployment Architecture 09-17-2018 0 3	0	3
How would you use an internal signed certificate with a Search Head (SH) cluster? I have a SH cluster and I would like to import an internal signed certificate to it. Looking for procedures on doing ... by pfabrizi Path Finder in Deployment Architecture 09-17-2018 1 5	1	5
How can I monitor the status of cluster nodes of Oracle RAC database 12c using splunk I use the command "crsctl status res -t" to view the status of rac cluster. by swetar New Member in Deployment Architecture 09-14-2018 0 2	0	2
What are Splunk Validated Architectures and where can I find them? I have heard about Splunk Validated Architectures (SVA), but I don't really know what they are and where I can find t... by s2_splunk Splunk Employee in Deployment Architecture 09-14-2018 2 1	2	1
Why am I getting the following "send failure" message in my internal logs: "pushing PK to search peer" ? Here is the complete warning message: Send failure while pushing PK to search peer = https://...:8089 , Read Ti... by jelizabeth New Member in Deployment Architecture 09-13-2018 0 4	0	4
Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it? When I attempt to run a basic search, index=foo sourcetype=*, and any other search, I get the following error message... by Jamaal Engager in Deployment Architecture 09-12-2018 0 3	0	3
Is it safe to remove excess buckets? Hi, I see some excess buckets in the bucket status tab in the indexer clustering page. Is it safe to click remove... by nawazns5038 Builder in Deployment Architecture 09-10-2018 0 1	0	1
Is there a document for best practices in decommissioning an indexer (IDX) cluster? Is there a document for best practices in decommissioning an IDX cluster? We are going back to stand alone indexer... by rbal_splunk Splunk Employee in Deployment Architecture 09-10-2018 0 1	0	1
How do I measure latency between search head cluster nodes? I am trying to figure out how I can measure the latency that my search head cluster nodes are experiencing between ea... by jeffbat Path Finder in Deployment Architecture 09-10-2018 0 0	0	0
Single-server Splunk (S1) on windows server 2012 2-node failover cluster - good idea? We need a High Availability (HA) Splunk Environment. The ideal architecture would be Distributed Clustered Deployment... by yangtse Explorer in Deployment Architecture 09-10-2018 0 0	0	0
Why does the collect command does not work for search head/indexer cluster and I received the following error "event for unconfigured/disabled/deleted"? Hi! i have an indexer on server_A and a search head on server_Bthere is an index=test_ind on server_Ai run a search ... by highsplunker Contributor in Deployment Architecture 09-08-2018 0 4	0	4
Cannot access appserver directly with appServerPorts configured. When I restart Splunk, I am getting an 503 Service Unavailable error. It also states on the page that "cannot access ... by rajindurbal Path Finder in Deployment Architecture 09-07-2018 1 1	1	1
In trying to create coldToFrozenDir, has anyone seen the following "load IndexConfig" error? I am trying to create coldToFrozenDir on one of my network indexes. I am trying to do this in the Development environ... by sreejith2k2 Explorer in Deployment Architecture 09-07-2018 0 2	0	2
HEC and Indexer Clustering The setup we have is as follows Master x 1 Indexers x 3 Search head x 1 I am trying to enable HEC on the indexers... by nickmarchini New Member in Deployment Architecture 09-06-2018 0 1	0	1
What is the opinion on using a single SAN mountpoint for both hot and cold buckets? We're getting ready to deploy new Linux indexers with VMAX storage and I'm thinking of just sending all of my buckets... by lycollicott Motivator in Deployment Architecture 09-06-2018 0 2	0	2

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Deployment Architecture

REST API trigger limits for search head

Uncooked Data Containing hostname

Is there a limitation on the amount of data an outlier can process?

Only splunkd.logs for index=_internal is visible for my AWS UF server

How search head knows which site primaries copies to search when search affinity is disabled in multisite clustering

Why does only specific data on my UF not being sent to my Indexers?

What is Search Head? Can it be seen in the UI?

Adding new indexer to indexer cluster

Why am I getting error "Cannot perform action "POST" without a target name to act on" trying to add a server to a serverclass via REST API?

Can you help me with Splunk password encryption for server.conf?

Will the below properties help us reach the following log retention goals?

How would you use an internal signed certificate with a Search Head (SH) cluster?

How can I monitor the status of cluster nodes of Oracle RAC database 12c using splunk

What are Splunk Validated Architectures and where can I find them?

Why am I getting the following "send failure" message in my internal logs: "pushing PK to search peer" ?

Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it?

Is it safe to remove excess buckets?

Is there a document for best practices in decommissioning an indexer (IDX) cluster?

How do I measure latency between search head cluster nodes?

Single-server Splunk (S1) on windows server 2012 2-node failover cluster - good idea?

Why does the collect command does not work for search head/indexer cluster and I received the following error "event for unconfigured/disabled/deleted"?

Cannot access appserver directly with appServerPorts configured.

In trying to create coldToFrozenDir, has anyone seen the following "load IndexConfig" error?

HEC and Indexer Clustering

What is the opinion on using a single SAN mountpoint for both hot and cold buckets?

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation