Deployment Architecture

Community Activity

Is it possible to make a deployment server a client of itself? Is it totally crazy to make a deployment server contact itself for apps? I just thought about it and it would reduce ... by chadwagonerKGI Engager in Deployment Architecture 11-06-2017 1 4	1	4
how to remove timestamp and host of heavy forwarder from data when it being forwarded to 3rd party system Hi, I have heavy forwarder which sending data to indexers, at the same time it sending same data to Qradar SEIM. Fo... by prathamesh_aug3 New Member in Deployment Architecture 11-06-2017 0 3	0	3
Getting new node in Management Console We are runing Splunk in AWS and lost one of our Indexers. All has recovered and I have removed the dead node but cann... by brent_weaver Builder in Deployment Architecture 11-05-2017 0 1	0	1
Set Data Retention Policy to delete data on rolling basis- not entire index Hello, Below is information I received about data retention: frozenTimePeriodInSecs sets the maximum age, in second... by katzr Path Finder in Deployment Architecture 11-04-2017 0 2	0	2
Custom Streaming Command Won't Distribute to Indexers (Python SDK, V2) I am writing a custom streaming search command using the Python SDK and the V2 Protocol. I followed the V2 protocol d... by kcnolan13 Communicator in Deployment Architecture 11-03-2017 2 9	2	9
Splunk Forwarder only sends a few Data from monitored logfile Greetings, I using a Splunk-Enterprice trail version and installed Forwarders on 3 different VMs. The Indexer Server... by toolanalyzer New Member in Deployment Architecture 11-03-2017 0 6	0	6
Why is bin command creating too many bins? Issue with 5-minute segments I have the same problem that is unanswered here I'm trying to do stats on the last 10 minutes of data by two separat... by FeatureCreeep Path Finder in Deployment Architecture 11-03-2017 0 4	0	4
Why is my search head missing in Distributed Management Console (DMC)? I'm sure this is going to be something simple. I have a small Splunk POC environment consisting of a cluster master,... by timmy13 Communicator in Deployment Architecture 11-03-2017 0 5	0	5
Forwarder won't stop forwarding A strange issue is happening, a few of our forwarders are sending a massive amount of data (wineventlog:security) to ... by mmoermans Path Finder in Deployment Architecture 11-03-2017 0 5	0	5
How do I "un-uninstall" a deployment server app? I was trying to remove an app from a serverclass and I clicked on Uninstall thinking that that would do it (there are... by woodcock Esteemed Legend in Deployment Architecture 11-02-2017 0 1	0	1
can i take $src_ip$ through1 index and use it other index in same query. If i have 1 index for firewall i can get src_ip and src_host which is creating some issues then i need to check that ... by rahul_acc_splun New Member in Deployment Architecture 11-02-2017 0 4	0	4
Changing the pass4SymmKey for Search Head Clustering not being encrypted in the Deployer We were having trouble with one of the Search Head cluster members. We went in to ensure that all of the shclustering... by sniderwj Explorer in Deployment Architecture 11-02-2017 0 1	0	1
Add cluster peer trying to reach wrong endpoint Hello I am using a NFR license. I am mounting a cluster environment in ubuntu, where my cluster master is on splunkd... by tiagofbmm Influencer in Deployment Architecture 11-02-2017 0 2	0	2
Changing mgmt port Hello I have a new Indexer instance of splunk with mgmt port 52400. Now if I put the Indexer peer configuration from ... by project9433 Engager in Deployment Architecture 11-02-2017 0 1	0	1
What is the best way to describe Deployment? I have gone through splunk docs it is like a puzzle for me to know about deployment. Can anyone give me perfect answe... by Rocky31 Path Finder in Deployment Architecture 11-01-2017 0 8	0	8
Disable search feature on Indexer Cluster Nodes Hi, I have configured SHC and Indexer cluster, Is there any way to disable search feature on Indexer cluster nodes, ... by rajeev_ku Path Finder in Deployment Architecture 11-01-2017 0 6	0	6
-bash: /opt/splunk/bin/splunk: No such file or directory When I try start splunk without sudo (or even logged in as root), I get a "no such file or directory" error. It works... by marcogallotta Explorer in Deployment Architecture 10-31-2017 1 2	1	2
Summary index does not meet my needs Hi. everyone.Please forgive my English level.I hope my description of the problem is clear enough.I have a lot of i... by xsstest Communicator in Deployment Architecture 10-31-2017 0 2	0	2
Upgrade of a Search Head Cluster (v6.4.2 > 7.0.0) - Can I do a rolling upgrade? Hi at all, I have to upgrade a Search Head Cluster from version 6.4.2 to 7.0.0 and I have a doubt: in https://docs.sp... by gcusello SplunkTrust in Deployment Architecture 10-31-2017 0 4	0	4
Splunk server roles Hello, could you explain me in details the possible roles of cluster member below and what would you advice for : 2... by splunkreal Influencer in Deployment Architecture 10-31-2017 0 4	0	4
Why does number of Indexers on Machines count in DMC>Overview Panel on Index Cluster Master Differ from Peers Searchable and Listing of Searchable Peers in Distributed Environment>Indexer Clustering Panel? I have 8 indexer instances in an indexer cluster with repFactor = 5. When logged into the index cluster master node's... by transtrophe Communicator in Deployment Architecture 10-31-2017 0 6	0	6
What's the proper way to add an indexer to an indexer cluster? We are about to add an indexer to an index cluster version 6.5.2. How do we it including the DMC part? by ddrillic Ultra Champion in Deployment Architecture 10-30-2017 0 5	0	5
Having trouble to forward data to Kiwi syslog Hi, I am trying forward data to Kiwi syslog. I have installed and configured a Heavy Forwarder and forward my syslog... by cemiam Path Finder in Deployment Architecture 10-30-2017 0 8	0	8
Index cluster data imbalance with high vol data sources We are running in an index cluster with 53 indxers and are findind that our high volume sources cause data imbalance.... by brent_weaver Builder in Deployment Architecture 10-27-2017 0 3	0	3
Error applying with indexes.conf when adding maxWarmDBcount So whilst modifying my index cluster configuration to be a little smarter with what data is maintained between hot/wa... by Joshuachurchill Engager in Deployment Architecture 10-27-2017 0 2	0	2