Deployment Architecture

Community Activity

How can I add the index to the fieldsummary as an extra column? If I do index=* \| fieldsummary I get the fieldsummary of all indices. How can I add the index to the fieldsummary as... by datitran New Member in Deployment Architecture 01-25-2018 0 1	0	1
How much Storage should I be considering? Hello community, First of all thank you for taking the time to look at my question. I will be ingesting the followin... by jesusgalloEMC Explorer in Deployment Architecture 01-24-2018 0 1	0	1
Data Rotation Configuration of indexes.conf The problem I am facing is that my data is going from hot/warm bucket to frozen bucket directly. However, I want it t... by AdsicSplunk New Member in Deployment Architecture 01-24-2018 0 13	0	13
Client stopped indexing as hostname, can only be found by IP now. We have had our splunk configured for about 2 years and not much has changed recently. All the sudden the other day ... by vonas Engager in Deployment Architecture 01-23-2018 0 6	0	6
Using Universal forwarder to send data from files in a folder to Splunk Enterprise Hi, I have no experience with Splunk, learning the ABCs of splunk so please be patient... I am configuring the univer... by neltonk Path Finder in Deployment Architecture 01-23-2018 0 2	0	2
Splunk index on a Windows log folder New to Splunk please help... I have created an index in Splunk enterprise and added a monitor to the splunk universa... by neltonk Path Finder in Deployment Architecture 01-23-2018 0 3	0	3
forwarders restarting Can anyone think of a reason that might cause all 32 of my Universal Forwarders to restart within a minute of 3:46 PM... by JarrettM Path Finder in Deployment Architecture 01-23-2018 0 8	0	8
Archiving speed is very very slow I tried to archive data by adding frozenTimePeriodInSecs and coldToFrozenDir settings for individual indexes in loca... by sudhir7 Explorer in Deployment Architecture 01-23-2018 0 3	0	3
I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in deployment server or support case with splunk? I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in ... by sridhar2901 New Member in Deployment Architecture 01-22-2018 0 1	0	1
prevent specific syslog from routing to 3rd party vendor using UDP:514 Is it possible to prevent specific logs from routing to a 3rd party vendor? We have IPS system that is generating too... by afamuyiwa Engager in Deployment Architecture 01-22-2018 0 1	0	1
Master server is not figuring in splunk_server list when searching in _internal Hello Splunkers, I have a problem when I'm searching in _internal index from my master server. My architecture cons... by mvagionakis Path Finder in Deployment Architecture 01-22-2018 0 7	0	7
Replicating/Copying files within Splunk SH Cluster members Hello, We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is... by ramesh_babu71 Path Finder in Deployment Architecture 01-22-2018 0 2	0	2
Splunk archiving setting not working properly I am testing the frozenTimePeriodInSecs setting, I have following default stanza in my indexes.conf file. [default] ... by sudhir7 Explorer in Deployment Architecture 01-21-2018 0 2	0	2
I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generati... by sridhar2901 New Member in Deployment Architecture 01-20-2018 0 4	0	4
Splunk-based aggregation tier? Client desires a physical aggregation point on the way into Azure where the real indexers will be. I guess this is f... by woodcock Esteemed Legend in Deployment Architecture 01-19-2018 0 2	0	2
Not getting all the files from forwarders Hi, I know there are lot of questions under the same topic,but i am stuck.i have an application server which forward... by carlyleadmin Contributor in Deployment Architecture 01-19-2018 0 11	0	11
How to change the SPLUNK_DB path on first run for 7.0.1 I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data. When... by jstockt New Member in Deployment Architecture 01-19-2018 0 2	0	2
Adding indexer cluster peers with different volume structures We're in the process of upgrading our indexer cluster, with the plan ultimately being to phase out the old indexer cl... by cdoebert Path Finder in Deployment Architecture 01-19-2018 0 5	0	5
How can I take Backup of My Saved Searches,Macros and Index Data ? Hi All, I am trying to move my entire project code into another server .So how can i arrange that set up . Mainly W... by ajayabburi508 Path Finder in Deployment Architecture 01-18-2018 1 9	1	9
Migrate from one index to another index with data integrity control Hi All, I recently have a new requirement to turn on data integrity control for a index ("X"). However, as the index... by lyukai New Member in Deployment Architecture 01-18-2018 0 2	0	2
How do you change the ulimits with Splunk 6.1 when starting from init.d? Can anyone explain the ulimit (max open files) behavior of Splunk 6.1? I've tried the traditional approach (adding e... by Lowell Super Champion in Deployment Architecture 01-18-2018 0 3	0	3
Changing/adding the clustering "Secret Key" to an existing cluster. I'm looking for information or suggestions about how to proceed with this. When configuring a cluster in Splunk, it ... by Ricapar Communicator in Deployment Architecture 01-18-2018 0 3	0	3
About server specifications I want to confirm about Splunk server specifications, For example, there are 1000 users who use the application, and... by zhenzhao New Member in Deployment Architecture 01-18-2018 0 1	0	1
Splunk forwarder read file content using sftp protocol Hi all, is it possible to configure Splunk forwarder to read a log file using sftp protocol? I have a log file on a r... by massit Explorer in Deployment Architecture 01-17-2018 0 2	0	2
Help with Time prefix and date format What time prefix and time format should I use. I will appreciate your help with this one. =INFO REPORT==== 15-Jan-20... by nipendo Engager in Deployment Architecture 01-17-2018 0 4	0	4