Deployment Architecture

Community Activity

How to find the passwd file under /splunk/etc directory in Linux Ubuntu? I have installed splunk in my Linux Ubuntu system. I have forgot the admin password and now I am trying to retrieve i... by Swatikeshari New Member in Deployment Architecture 04-16-2018 0 1	0	1
index-cluster We have two indexer, When I created new index on Master Node and pushed them into 2 indexer, Only one Indexer can rec... by vumanhtai Path Finder in Deployment Architecture 04-14-2018 0 5	0	5
Clarification on Clustering & Index Replication Hi All, In reading a recently posted (16 Oct 2013) Splunk blog post "Clustering Optimizations in Splunk 6", the foll... by rturk Builder in Deployment Architecture 04-14-2018 1 5	1	5
Are there any subtleties to setting up a search head cluster in docker containers that could result in a Search Head Clustering(not enabled on this node)? Hello, I have seen how common this issue seems to be, but have not been able to get my search head cluster to set up... by dtow1 Path Finder in Deployment Architecture 04-13-2018 0 3	0	3
In our environment we have two search head (A & B) In our environment we have two search head (A & B) but we have configured A search head nearly 3000 Scheduled alert ... by satkan100 Path Finder in Deployment Architecture 04-13-2018 0 2	0	2
Is forwardedindex.. only applicable for TCP connection? Hi, I am using heavy forwarder to forward syslogs to a 3rd party syslog aggregator. I am trying to filter some of th... by cemiam Path Finder in Deployment Architecture 04-13-2018 0 12	0	12
How do you synchronize serverclass.conf and your deploymentapps across loadbalanced deployment servers? I was wondering how the community handled this challenge? As our forwarder infrastructure is growing we are looking ... by paimonsoror Builder in Deployment Architecture 04-12-2018 0 3	0	3
Heavy Forwarder without EFK I am quite new in Splunk architecture (Open Shift Plattform) . We are using EFK Nodes in our plattform (bare metall) ... by netuse1955 New Member in Deployment Architecture 04-12-2018 0 1	0	1
Configure "Run a script" and push script using REST API I want to configure "run a script" using rest end point. I do not find any REST PI to do that apart from deprecated ... by yashveer_arya Engager in Deployment Architecture 04-11-2018 0 0	0	0
getting bombarded with windows security error code 5156 and 5157 (Win security) Hello All, I have a distributed system where i have a heavy forwarder collecting traffic from the UF's and forward... by ranjitbrhm1 Communicator in Deployment Architecture 04-11-2018 0 4	0	4
Unable to anonymise data even after we have right regex. I have a log file as detailed below. "02d4224f-8cc8-48b4-a06d-034a97ad68a8-333999","2018-03-24T04:58:09.280Z","OPENI... by vikram_m Path Finder in Deployment Architecture 04-11-2018 0 3	0	3
AutoLB Volume Hi All, I have 60 indexers and 40 forwarders, I want to set the AutoLB volume, do you know a metric search to calcul... by asabatini85 Path Finder in Deployment Architecture 04-11-2018 0 3	0	3
Moving SPLUNK_HOME My forwarder was installed under a non standard folder. /opt/splunkforwarder I noticed that the tar file for the ver... by pfabrizi Path Finder in Deployment Architecture 04-11-2018 0 2	0	2
Filtering CISCO events on Forwarder I have a CISCO monitor file log on a lightweight forwarder. We want to blacklist specific events, like teardowns and ... by pfabrizi Path Finder in Deployment Architecture 04-10-2018 0 22	0	22
What is the best way to deploy splunk on very strong machines? Hi we have 6 physical machines with 512Gb RAM, 56 CPU, and 10 disks with 12Tb each. We want to use them for splunk in... by eylonronen Explorer in Deployment Architecture 04-10-2018 0 3	0	3
Replace data on each import? I'm using Best Practical "Request Tracker 4" as my ticketing system, and I'm trying to pull the data in to Splunk for... by jcooperFossil Path Finder in Deployment Architecture 04-10-2018 0 0	0	0
replication was unsuccessful. failed_because_REMOTE_CHKSUM_UNMATCHED Bundle checksum match fails on Search Head hundreds of times per day, we are seeing the same local bundle failing to ... by sylim_splunk Splunk Employee in Deployment Architecture 04-10-2018 1 4	1	4
Configure Universal Forwarder to multiple SIEMs Hopefully a straight forward question, can the SPLUNK universal forwarder (or the SPLUNK heavy forwarder) send to dif... by willadams Contributor in Deployment Architecture 04-10-2018 0 5	0	5
how to user serverclass with aws servers that names and ip's change each time they get rebuilt we have a few small applications in aws I would like to use my on prem deployment server to services these servers. ... by bobmccoy Explorer in Deployment Architecture 04-09-2018 0 2	0	2
Where my Fields at in Splunk 7.0? (Homie!) I've created some field extractions from sourcetypes such as syslog and access_common on my search head. These are al... by baegoon Explorer in Deployment Architecture 04-09-2018 0 6	0	6
Distributed search performance troubles I have a setup with one cluster master, one indexer cluster (with 3 peers), one non-clustered indexer and one search ... by pcsegal Explorer in Deployment Architecture 04-09-2018 0 6	0	6
Hi, I am using Splunk enterprise, I limits the indexes I have to certain max size but it keeps exceeded this size, why ? Hi, I am using Splunk enterprise, I limits the indexes I have to certain max size but it keeps exceeded this size, w... by fshamala New Member in Deployment Architecture 04-09-2018 0 2	0	2
Why is my search head cluster not working after updating to Splunk 6.5.0? My search head cluster is no longer working after an update from 6.4 to 6.5.0 (I think it was the update!). It seemed... by brent_weaver Builder in Deployment Architecture 04-08-2018 0 9	0	9
What happens to a bucket if all of the data within it is deleted? Just what the title says. If I delete a bunch of data from an index and some of the buckets are now effectively empt... by caseyra Explorer in Deployment Architecture 04-06-2018 0 7	0	7
How to add forward server in non-interactive mode I want to use Ansible or script to install Splunk on Linux servers. When I issue "splunk add forward-server server_ip... by pshangguan New Member in Deployment Architecture 04-05-2018 0 3	0	3