Deployment Architecture

Community Activity

Is Splunk Enterprise 7.1.1 compatible with Ubuntu 18.04 Server x64? Is it safe to run Splunk Enterpise 7.1.1 on Ubuntu 18.04 Server x64? Has it been tested at all? I have not been ... by linsdakr Engager in Deployment Architecture 06-08-2018 1 2	1	2
error internal log deployment server Hi All, I found this error on on my internal log: "Caught exception='Application does not exist: app name' while rel... by asabatini85 Path Finder in Deployment Architecture 06-08-2018 0 4	0	4
How to remove something from being indexed? Hello Team, Can someone help me figure out how to delete a data source? I went over the limit for the 500MB a day wi... by rogue_carrot Communicator in Deployment Architecture 06-08-2018 0 5	0	5
what will happen if you restart deployment server? what will happen if you restart deployment server? do you need to reconfigure DS? I'm not seeing the complete client... by teddyidc1101 Communicator in Deployment Architecture 06-07-2018 0 3	0	3
Lost all indexes Hi, I created an App on my Splunk indexer which had a props.conf, outputs.conf and transforms.conf with the followin... by satiex Explorer in Deployment Architecture 06-07-2018 0 2	0	2
When does Splunk dump data? All, When does Splunk look at the time on a piece of data and determine the data is aged beyond the index retention... by daniel333 Builder in Deployment Architecture 06-07-2018 0 0	0	0
Same source file across multiple hosts - split by sourcetype Afternoon guys & gals, The scenario I face is as such - we have multiple hosts all feeding data into a single index.... by Barty Explorer in Deployment Architecture 06-07-2018 0 4	0	4
Why would my audit index grow to over 300g suddenly? Why would my audit index grow to over 300g suddenly? This happened on the SH. The _audit index normally sits at about... by MikeBertelsen Communicator in Deployment Architecture 06-07-2018 0 2	0	2
Yet another Windows Splunk Forwarder uninstall question Hi everyone, so far not seeing a simpler solution for me. Windows Server 2008 R2 w/ 5.0.4 Build 172409 splunk.exe... by glen_w New Member in Deployment Architecture 06-07-2018 0 0	0	0
Can someone help me understand multisite indexer replication? All, let's say I have 6 data centers. one is INSANELY small and another very large. How does mutli-site indexer repl... by daniel333 Builder in Deployment Architecture 06-07-2018 0 3	0	3
Splunk Distributed Management Console read only user Hello, please I would like to know if and how is possible to define/create a user that has only the capability to nav... by cafissimo Communicator in Deployment Architecture 06-07-2018 0 2	0	2
Search View Not Displayed for Custom Role Hello, Hoping someone can point out what I may be missing. I have two new users I'm adding to our Splunk instance. I... by g038123 Explorer in Deployment Architecture 06-07-2018 0 1	0	1
To determine the start time from one log record and end time from another log record which have the same key. The key is docKey for each of the three records. I need the start time from log having action=UPLOAD and end time fro... by paismm123 New Member in Deployment Architecture 06-06-2018 0 2	0	2
Striped LVM volume best practices What are the best practices for using LVM striped volumes on an indexer? The indexer machines have 8 NVE flash drive... by responsys_cm Builder in Deployment Architecture 06-06-2018 0 0	0	0
Splunk 7.1.0 Memory and Replication Issues in Multi-Site Index Cluster Upgrading from Splunk Enterprise 6.6.2 to 7.1.0 introduced two major problems: 1) Memory Usage on the Indexers would ... by timothywatson Path Finder in Deployment Architecture 06-06-2018 1 3	1	3
What is causing HotBucketRoller errors? I need to understand what could be causing these errors. Seeing them frequently on one of our sytems. 04-13-2018 07:... by simpkins1958 Contributor in Deployment Architecture 06-05-2018 1 3	1	3
Forward Splunk Cloud's Audit log to third party system We are using Self service Splunk cloud and we do not have access to CLI. In addition, we are not using any deployment... by aanataliya Explorer in Deployment Architecture 06-05-2018 0 1	0	1
Permission Distributed Search Hello, Architecture: I have a distributed Seach (not in Cluster) 1 Search head and 1 Indexer. Every logs are stored... by dalie Explorer in Deployment Architecture 06-05-2018 0 5	0	5
executionpolicy powershell hi i use a powershell script with a scheduled task the script is in this folder C:\Program Files\xxx\etc\apps\xxx\b... by jip31 Motivator in Deployment Architecture 06-05-2018 0 1	0	1
Failed to create a bundles setup with server name Hi , Im trying to connect the sh cluster to indexer cluster,Im using Splunk Version 7. All the status are ok. But e... by jarize_loyola Engager in Deployment Architecture 06-05-2018 0 3	0	3
How to calculate the tota runtime from different logs? I have 100+ logs in my path say /abv/xyz/(All my logs). Each of the logs has the line: The total runtime is "zy" sec... by tchintam Path Finder in Deployment Architecture 06-05-2018 0 3	0	3
Masking _raw after indexing depending on Role I know that there are a lot of answers regarding masking data and it all comes down to masking it at index time. Howe... by JordanPeterson Path Finder in Deployment Architecture 06-04-2018 0 2	0	2
Components of splunk architecture with its function In our SIEM team meeting had discussion like we have100+ splunk servers ? What does splunk server mean ? is it Splun... by CryoHydra Path Finder in Deployment Architecture 06-02-2018 0 7	0	7
Splunk forwarder in EC2 not reaching the indexer I've installed splunk forwarder inside a Docker container and when I use a local VM I am able to see the events comin... by mirceaned New Member in Deployment Architecture 05-31-2018 0 0	0	0
How to configure Multisite Search head clustering Environment using Deployer? Please let me know the configurations to perfom the Multisite search head clustering based on deployer NOTE: We ha... by gkumarashanmuga Explorer in Deployment Architecture 05-31-2018 0 2	0	2