Deployment Architecture

Discussions

Thread Info

getting bombarded with windows security error code 5156 and 5157 (Win security)

Hello All, I have a distributed system where i have a heavy forwarder collecting traffic from the UF's and forwarding...

by Communicator in

Unable to anonymise data even after we have right regex.

I have a log file as detailed below. "02d4224f-8cc8-48b4-a06d-034a97ad68a8-333999","2018-03-24T04:58:09.280Z","OPE...

by Path Finder in

AutoLB Volume

Hi All, I have 60 indexers and 40 forwarders, I want to set the AutoLB volume, do you know a metric search to calc...

by Path Finder in

Moving SPLUNK_HOME

My forwarder was installed under a non standard folder. /opt/splunkforwarder I noticed that the tar file for the ver...

by Path Finder in

Filtering CISCO events on Forwarder

I have a CISCO monitor file log on a lightweight forwarder. We want to blacklist specific events, like teardowns and ...

by Path Finder in

What is the best way to deploy splunk on very strong machines?

Hi we have 6 physical machines with 512Gb RAM, 56 CPU, and 10 disks with 12Tb each. We want to use them for splunk in...

by Explorer in

Replace data on each import?

I'm using Best Practical "Request Tracker 4" as my ticketing system, and I'm trying to pull the data in to Splunk for...

by Path Finder in

replication was unsuccessful. failed_because_REMOTE_CHKSUM_UNMATCHED

Bundle checksum match fails on Search Head hundreds of times per day, we are seeing the same local bundle failing to ...

by Splunk Employee in

Configure Universal Forwarder to multiple SIEMs

Hopefully a straight forward question, can the SPLUNK universal forwarder (or the SPLUNK heavy forwarder) send to dif...

by Contributor in

how to user serverclass with aws servers that names and ip's change each time they get rebuilt

we have a few small applications in aws I would like to use my on prem deployment server to services these servers. ...

by Explorer in

Where my Fields at in Splunk 7.0? (Homie!)

I've created some field extractions from sourcetypes such as syslog and access_common on my search head. These are al...

by Explorer in

Distributed search performance troubles

I have a setup with one cluster master, one indexer cluster (with 3 peers), one non-clustered indexer and one search ...

by Explorer in

Hi, I am using Splunk enterprise, I limits the indexes I have to certain max size but it keeps exceeded this size, why ?

Hi, I am using Splunk enterprise, I limits the indexes I have to certain max size but it keeps exceeded this size, w...

by New Member in

Why is my search head cluster not working after updating to Splunk 6.5.0?

My search head cluster is no longer working after an update from 6.4 to 6.5.0 (I think it was the update!). It seemed...

by Builder in

What happens to a bucket if all of the data within it is deleted?

Just what the title says. If I delete a bunch of data from an index and some of the buckets are now effectively empty...

by Explorer in

How to add forward server in non-interactive mode

I want to use Ansible or script to install Splunk on Linux servers. When I issue "splunk add forward-server server_ip...

by New Member in

SSH login gets disable whenever splunk forwarder starts

Dear Concern, We have a distributed environment of Splunk, where we forward data to indexer via heavy forwarders. ...

by New Member in

How to remove this error "peer has status="Down". Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available"?

Can any one please tell me how to remove the error - peer has status="Down". Please verify uri-scheme, connectivity t...

by New Member in

Pre-canned Linux source types under /var/log

Is there any documentation about which files are covered by the pre-canned source types for linux? Specifically, ther...

by Explorer in

How to forward indexed data to another splunk indexer cluster ?

We have a Indexer Cluster And Search Head Cluster. We need to send all data in a standalone Splunk instance to the in...

by Explorer in

Compression ratio for index replication

Hi all, We are currently estimating our network bandwidth needs and one of the questions we are trying to answer i...

by Super Champion in

replicate existing multi-site indexer cluster to new multi-site Indexer cluster

We have an existing multi-site indexer cluster of 8 indexers, we have got 16 new indexers and have to migrate the cur...

by New Member in

Getting the following error in splunkd - Could not find user="system" with strategy="LDAP"

Hello community fellows, I'm experiencing the following errors in splunkd from each of the shc members. INFO A...

by Path Finder in

SSL is working for Forwarder-Indexer, but not Deployment Client-Server traffic

Hi. I have a Deployment Server, and I am using it to configure a Deployment Client, which is a Windows Universal Forw...

by Path Finder in

Connecting a standalone search head to only 1 indexer

Hi Guys, I'm trying to connect a standalone search head to only 1 indexer. It's a simple setup, however I just not...

by New Member in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

getting bombarded with windows security error code 5156 and 5157 (Win security)

Unable to anonymise data even after we have right regex.

AutoLB Volume

Moving SPLUNK_HOME

Filtering CISCO events on Forwarder

What is the best way to deploy splunk on very strong machines?

Replace data on each import?

replication was unsuccessful. failed_because_REMOTE_CHKSUM_UNMATCHED

Configure Universal Forwarder to multiple SIEMs

how to user serverclass with aws servers that names and ip's change each time they get rebuilt

Where my Fields at in Splunk 7.0? (Homie!)

Distributed search performance troubles

Hi, I am using Splunk enterprise, I limits the indexes I have to certain max size but it keeps exceeded this size, why ?

Why is my search head cluster not working after updating to Splunk 6.5.0?

What happens to a bucket if all of the data within it is deleted?

How to add forward server in non-interactive mode

SSH login gets disable whenever splunk forwarder starts

How to remove this error "peer has status="Down". Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available"?

Pre-canned Linux source types under /var/log

How to forward indexed data to another splunk indexer cluster ?

Compression ratio for index replication

replicate existing multi-site indexer cluster to new multi-site Indexer cluster

Getting the following error in splunkd - Could not find user="system" with strategy="LDAP"

SSL is working for Forwarder-Indexer, but not Deployment Client-Server traffic

Connecting a standalone search head to only 1 indexer

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

Splunk and Fraud

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Setup Splunk on AWS Elastic Beanstalk

Splunk Intermediate Forwarder Setup

CMMC Version 2.0

Stream forwarder only works when running as root

Search Cluster Overwriting etc/system/local/inputs...