Deployment Architecture

Community Activity

Do I need to have autoLB on the search head? I am getting the message Forwarding to indexer group default-autolb-group blocked for 100 seconds I am running ... by scottrunyon Contributor in Deployment Architecture 08-21-2017 0 3	0	3
How can I run a local search on my deployment server and make the results accessible for search? Hello, I have a query that needs to run locally on the deployment server, but I want the results accessible on my se... by quihong Path Finder in Deployment Architecture 08-21-2017 0 2	0	2
"Got Done key for an unknown bucket without getting any data" I have a MultiSite indexing cluster, and a single Peer int site 2 is repeatedly reporting: ERROR TcpInputProc - even... by nickhills Ultra Champion in Deployment Architecture 08-21-2017 1 2	1	2
Does a replication factor of three make sense? Our eight indexers are under enormous stress and I wonder whether the replication factor of three makes any sense. Si... by ddrillic Ultra Champion in Deployment Architecture 08-20-2017 0 3	0	3
How do I add a new node to a multisite indexer cluster? Hello All i'm trying to find the way to to add new member to indexer cluster. do i need to follow same step that i u... by saifuddin9122 Path Finder in Deployment Architecture 08-18-2017 0 2	0	2
Splunk TA Sharepoint error messages This is a distributed deployment with a search head cluster and index cluster. The Splunk_TA_Microsoft_Sharepoint ad... by JovanMilosevic Path Finder in Deployment Architecture 08-18-2017 0 1	0	1
Is there a REST API to create a deployment app on a deployment server? Hi, Are there REST APIs to: 1. Create a deployment app on a deployment server 2. Create some conf files in that app... by anton085 Path Finder in Deployment Architecture 08-16-2017 0 2	0	2
Changing deployment server IP Hi to all, I had a deployment server (server A), an indexer/search head (server B) and some monitored servers. I co... by andreac81 Explorer in Deployment Architecture 08-16-2017 0 2	0	2
Can the indexer cluster master itself decide to be a search head? Hello Team, I am very curious to know the answer of this question. I have an index clustering setup consisting of o... by shahk Explorer in Deployment Architecture 08-16-2017 0 2	0	2
Audit - Tampering of Log Files by Unix Admin Possible? I understand that 'Splunk Log Files/Index events' can be deleted (made non-searchable) with the 'can_delete' operator... by marcolu5 New Member in Deployment Architecture 08-16-2017 0 3	0	3
Linux logging on Splunk I want to know industry standard for Linux system logging for security purpose. What files needs to be logged and how... by mksingh New Member in Deployment Architecture 08-16-2017 0 1	0	1
Splunk Apps that are installed on a deployment client running a universal forwarder (From Distributed SH) As per somesoni2 answer in https://answers.splunk.com/answers/426786/is-there-a-way-to-get-a-list-of-splunk-apps-that... by koshyk Super Champion in Deployment Architecture 08-16-2017 0 2	0	2
Migrating ITSI from shared search head to dedicated search head? I'm looking to migrate ITSI 2.4 (IT Service Intelligence), which is on a shared, clustered set of search heads (SH)'s... by jtsplunk Splunk Employee in Deployment Architecture 08-15-2017 0 2	0	2
How can I resolve this error I get from adding a new search head to my indexer clustering environment? After I added a new search head to my indexer cluster environment, I started getting "Error = 'Couldn't deserialize, ... by daniel_splunk Splunk Employee in Deployment Architecture 08-15-2017 0 1	0	1
Index Cluster Scaling Is there a limit for the number of nodes in an indexer cluster, above wich we will see a performance degradation? Wit... by FritzWittwer_ol Contributor in Deployment Architecture 08-15-2017 0 2	0	2
How to block a server from pushing data to our Splunk server We have a couple of unknown servers that push data to our Splunk serverI am not able to access these servers and not ... by edwinmae Path Finder in Deployment Architecture 08-14-2017 0 8	0	8
How to dynamically change the span parameter in bucket without using drop down options. I have a search like this: index=* source=*\|....\| bucket Time span=(1d/1h/5m)...\| if I select last one month from t... by karthikeyan_k14 New Member in Deployment Architecture 08-14-2017 0 3	0	3
Splunk log filtering via Splunk Heavy forwarder Hello, I have the the logs coming from our IPS coming in below format: Connection logs: Aug 10 08:54:44 HOST SFIMS:... by Sayanta_Basak_I Explorer in Deployment Architecture 08-14-2017 0 4	0	4
Scripted input not indexing fully Hi Team, I have deployed a scripted input on the Cluster Master which will gives us the last accessed, modified time... by siva_cg Path Finder in Deployment Architecture 08-14-2017 0 7	0	7
Why does a peer in an indexer cluster not have the "cluster_label" label? I have a clustered environment with many indexers, but for some reason one of the indexers are not playing nice with ... by bchau123 Engager in Deployment Architecture 08-10-2017 0 16	0	16
How do I change the owner of a saved search or view in a search head cluster environment? I need to change the owner of a search or dashboard view. Using the deployer merges changes from local.meta back to d... by rphillips_splk Splunk Employee in Deployment Architecture 08-10-2017 4 6	4	6
How do I determine the appropriate timeout value for distributed search I see timeouts with distributed search and currently have receiveTimeout set to 300. What metric(s) can I use to det... by matt Splunk Employee in Deployment Architecture 08-09-2017 2 3	2	3
Bucket number exceeds maxHotBuckets value Hi, In my splunk configurtation I have defined the maxHotBuckets to default value, so 3. When I monitor my indexers ... by osec2a New Member in Deployment Architecture 08-09-2017 0 9	0	9
Adding users via REST API on search head cluster Is it possible to add users via the Splunk REST API in a SH cluster? I thought that I had tested this but now when I... by brent_weaver Builder in Deployment Architecture 08-09-2017 1 1	1	1
How can I get the shc status from the deployer Hi, We have a SHC setup in our private cloud. So, picture servers going in/out/down/up... without the Splunk admin'... by a212830 Champion in Deployment Architecture 08-09-2017 0 2	0	2