Deployment Architecture

Community Activity

Can Splunk Universal forwarder be used to delete logs from a particular server.(Log rotation/deletion) e.g. I have a universal forwarder installed on a server on which an application is running. The purpose of the UF is ... by bmoniz New Member in Deployment Architecture 01-26-2018 0 1	0	1
default.old directories in SHC Hi, There are thousands of default.old.<date-time> directories under /opt/splunk/etc/apps/<app_name>/ There was si... by strive Influencer in Deployment Architecture 01-26-2018 0 1	0	1
Error encountered for display this error message - [subsearch]: Could not find an index named "_blocksignature". is encountered when performing a s... by hkchew New Member in Deployment Architecture 01-26-2018 0 1	0	1
How can I add the index to the fieldsummary as an extra column? If I do index=* \| fieldsummary I get the fieldsummary of all indices. How can I add the index to the fieldsummary as... by datitran New Member in Deployment Architecture 01-25-2018 0 1	0	1
How much Storage should I be considering? Hello community, First of all thank you for taking the time to look at my question. I will be ingesting the followin... by jesusgalloEMC Explorer in Deployment Architecture 01-24-2018 0 1	0	1
Data Rotation Configuration of indexes.conf The problem I am facing is that my data is going from hot/warm bucket to frozen bucket directly. However, I want it t... by AdsicSplunk New Member in Deployment Architecture 01-24-2018 0 13	0	13
Client stopped indexing as hostname, can only be found by IP now. We have had our splunk configured for about 2 years and not much has changed recently. All the sudden the other day ... by vonas Engager in Deployment Architecture 01-23-2018 0 6	0	6
Using Universal forwarder to send data from files in a folder to Splunk Enterprise Hi, I have no experience with Splunk, learning the ABCs of splunk so please be patient... I am configuring the univer... by neltonk Path Finder in Deployment Architecture 01-23-2018 0 2	0	2
Splunk index on a Windows log folder New to Splunk please help... I have created an index in Splunk enterprise and added a monitor to the splunk universa... by neltonk Path Finder in Deployment Architecture 01-23-2018 0 3	0	3
forwarders restarting Can anyone think of a reason that might cause all 32 of my Universal Forwarders to restart within a minute of 3:46 PM... by JarrettM Path Finder in Deployment Architecture 01-23-2018 0 8	0	8
Archiving speed is very very slow I tried to archive data by adding frozenTimePeriodInSecs and coldToFrozenDir settings for individual indexes in loca... by sudhir7 Explorer in Deployment Architecture 01-23-2018 0 3	0	3
I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in deployment server or support case with splunk? I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in ... by sridhar2901 New Member in Deployment Architecture 01-22-2018 0 1	0	1
prevent specific syslog from routing to 3rd party vendor using UDP:514 Is it possible to prevent specific logs from routing to a 3rd party vendor? We have IPS system that is generating too... by afamuyiwa Engager in Deployment Architecture 01-22-2018 0 1	0	1
Master server is not figuring in splunk_server list when searching in _internal Hello Splunkers, I have a problem when I'm searching in _internal index from my master server. My architecture cons... by mvagionakis Path Finder in Deployment Architecture 01-22-2018 0 7	0	7
Replicating/Copying files within Splunk SH Cluster members Hello, We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is... by ramesh_babu71 Path Finder in Deployment Architecture 01-22-2018 0 2	0	2
Splunk archiving setting not working properly I am testing the frozenTimePeriodInSecs setting, I have following default stanza in my indexes.conf file. [default] ... by sudhir7 Explorer in Deployment Architecture 01-21-2018 0 2	0	2
I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generati... by sridhar2901 New Member in Deployment Architecture 01-20-2018 0 4	0	4
Splunk-based aggregation tier? Client desires a physical aggregation point on the way into Azure where the real indexers will be. I guess this is f... by woodcock Esteemed Legend in Deployment Architecture 01-19-2018 0 2	0	2
Not getting all the files from forwarders Hi, I know there are lot of questions under the same topic,but i am stuck.i have an application server which forward... by carlyleadmin Contributor in Deployment Architecture 01-19-2018 0 11	0	11
How to change the SPLUNK_DB path on first run for 7.0.1 I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data. When... by jstockt New Member in Deployment Architecture 01-19-2018 0 2	0	2
Adding indexer cluster peers with different volume structures We're in the process of upgrading our indexer cluster, with the plan ultimately being to phase out the old indexer cl... by cdoebert Path Finder in Deployment Architecture 01-19-2018 0 5	0	5
How can I take Backup of My Saved Searches,Macros and Index Data ? Hi All, I am trying to move my entire project code into another server .So how can i arrange that set up . Mainly W... by ajayabburi508 Path Finder in Deployment Architecture 01-18-2018 1 9	1	9
Migrate from one index to another index with data integrity control Hi All, I recently have a new requirement to turn on data integrity control for a index ("X"). However, as the index... by lyukai New Member in Deployment Architecture 01-18-2018 0 2	0	2
How do you change the ulimits with Splunk 6.1 when starting from init.d? Can anyone explain the ulimit (max open files) behavior of Splunk 6.1? I've tried the traditional approach (adding e... by Lowell Super Champion in Deployment Architecture 01-18-2018 0 3	0	3
Changing/adding the clustering "Secret Key" to an existing cluster. I'm looking for information or suggestions about how to proceed with this. When configuring a cluster in Splunk, it ... by Ricapar Communicator in Deployment Architecture 01-18-2018 0 3	0	3