Deployment Architecture

Start a Conversation

Discussions

Start a Conversation

Thread Info

What specs are needed for a deployment server to manage 1500 - 2000 forwarders in a multisite indexer clustering environment?

Hello, I am assembling a multisite clustered Splunk implementation. I am having a little trouble finding what suff...

by Communicator in

How to configure Splunk forwarder for Layer7 logs?

Hello friends, I have Layer7(CA technologies) running on a virtual machine and I access it using SSH. My spl...

by Explorer in

Are there any gotchas setting up Hunk Search Head Clustering over both an Indexer Cluster and Virtual Indexes

Is there anything to take into account for setting up a Hunk Search Head cluster both with virtual indexes mapped int...

by Builder in

Search Head Cluster: "WARN...single_action=PUSH_TO took wallclock_ms=1553! Consider a lower value of conf_replication_max_push_count in server.conf on all members"

We have three Node Search Head Cluster member and we are seeing the following messages in our splunkd.log: 12-08-2...

by Communicator in

Minimum peer number for multi site clustering

Hi all, Am planning a multi site clustering (2 site) installation of Splunk 6.3 as the small start deployment. No...

by Explorer in

Master and Search Head together?

Is it possible to configure Master and Search head together in one spunk instance? If it is, what should I take note ...

by Path Finder in

Search Head Clustering : Preferred approach Odd number or Even number per site?

folks, We have two sites and we host 8 Search Heads (4 per site) all clustered with 16 indexers. We need to have a no...

by Super Champion in

Is there a CLI command to enable or disable serach peers in Splunk 6.3.1?

I have added the PROD and DR indexer hosts using add search-server CLI command. Now my requirement is to keep the PRO...

by Path Finder in

How to troubleshoot Search Head Clustering initial bootstrap failing with error "found different peer with serverName and hostport already registered and UP"?

I am trying to make three Search Head Cluster Member Bootstrap and it is failing with the following error: You we...

by Splunk Employee in

If a deployment server crashes and we don't have a backup, will clients start using a fresh installed deployment server if I use the same ip/hostname

Hi! Let's imagine that deployment server has crashed and we don't have full backup to restore it from. What will h...

by Engager in

How to sync apps and configurations without a deployment server in my distributed search environment?

Hi! I have 4 Splunk servers (one per each geographical location), each with combined Indexer and Search Head roles...

by Engager in

Authentication Failed using distributed search

Has anyone come across this message in an environment where distributed search is used: Unable to distribute to peer ...

by Motivator in

Removed a index from clustered environment

Hi Splunkers, What is the best way to remove an index along with all buckets (stored in the disk), from the Splunk...

by Motivator in

How many resources do I commit to a master node in distributed multisite indexer clustering deployment?

I am in the process of setting up a distributed clustered deployment that spans 3 different sites. The deployment wil...

by Communicator in

Why am I seeing "DistributedPeerManagerHeartbeat - Unable to get server info from peer... due to connection reset" on my cluster master log?

I have seen a few other questions similar to this one, but not exactly, and the solutions do not work. In my clust...

by Explorer in

Deployment Architecture

Discussions

What specs are needed for a deployment server to manage 1500 - 2000 forwarders in a multisite indexer clustering environment?

How to configure Splunk forwarder for Layer7 logs?

Are there any gotchas setting up Hunk Search Head Clustering over both an Indexer Cluster and Virtual Indexes

Search Head Cluster: "WARN...single_action=PUSH_TO took wallclock_ms=1553! Consider a lower value of conf_replication_max_push_count in server.conf on all members"

Minimum peer number for multi site clustering

Master and Search Head together?

Search Head Clustering : Preferred approach Odd number or Even number per site?

Is there a CLI command to enable or disable serach peers in Splunk 6.3.1?

How to troubleshoot Search Head Clustering initial bootstrap failing with error "found different peer with serverName and hostport already registered and UP"?

If a deployment server crashes and we don't have a backup, will clients start using a fresh installed deployment server if I use the same ip/hostname

How to sync apps and configurations without a deployment server in my distributed search environment?

Authentication Failed using distributed search

Removed a index from clustered environment

How many resources do I commit to a master node in distributed multisite indexer clustering deployment?

Why am I seeing "DistributedPeerManagerHeartbeat - Unable to get server info from peer... due to connection reset" on my cluster master log?

How to install AWS Splunk App on clustered environment?

How to provide high availability for an indexer cluster master node and search head in AWS?

Where in a Linux server is the Distributed Management Console monitoring disk space metrics?

Is there a way to limit the number of clients a Splunk deployment server pushes a new/updated app to at the same time?

Why am I unable to start 2 of 4 search heads with "WARNING: web interface does not seem to be available!"?

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!

Submit Now! >

What type of restart happens during a normal index...

Can I download the forwarder with sha1?

Would Data Rebalance of Primary Cluster Buckets Wo...

'Local side shutting down' error on a search head ...

UF not sending data to HF on 9997

Deployment Architecture

Discussions

Don't miss your chance to share your Splunk wisdom in-person or virtually at .conf21!Call for Speakers hasbeen extended throughThursday, 5/20! Submit Now! >

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!

Submit Now! >