Deployment Architecture

Community Activity

Help creating log field extraction regex Hello, We have several comma delimited logs with static set of fields. I want to extract the fields with use of rege... by ptur Path Finder in Deployment Architecture 07-31-2017 0 4	0	4
Whitelist for WinEventLog does not filter with two fields EventCode and Logon_Type Hallo, i need help for this stanza. I want only Events for "EventCode=4624 and Logon_Type=10" . Whitelist2 works fin... by gerdhuber Explorer in Deployment Architecture 07-31-2017 0 2	0	2
Why are scheduled reports failing to run after enabling search head clustering in Splunk 6.2.1? We just enabled SHC 6.2.1 and I'm finding none of my scheduled reports are running at all. As a test, I created a si... by Chubbybunny Splunk Employee in Deployment Architecture 07-30-2017 3 2	3	2
Is it possible to configure a single splunk instance being index master, index peer node, and search head? I am going to building a small Splunk cluster with 3 Splunk instances and would like all nodes be able to do indexing... by danielwan Explorer in Deployment Architecture 07-29-2017 0 7	0	7
How to differ input files in universal forwarder I'm using the universal forwarder, assume i have following log files: bar-20170728.log and bar-20170728-foo.log ... by mkrauss1 Explorer in Deployment Architecture 07-28-2017 0 2	0	2
How to get the number of universal forwarder to send and receive I want to create an alert to reminde to remind me that the number of logs sent by forwarders is increasing dramatical... by xsstest Communicator in Deployment Architecture 07-28-2017 0 6	0	6
After installing Splunk on Linux and I navigate to Apps in Splunk, why do I get "The splunkd daemon cannot be reached by splunkweb"? I just installed Splunk on a Linux server and when I navigate to the Apps in Splunk, I get the following: "503 Servi... by mlapilusa Engager in Deployment Architecture 07-27-2017 0 4	0	4
What could be the best approach to migrate an existing single-site indexer cluster to multi-site cluster ? Hi Splunkers, We are going to migrate our current single-site indexer cluster (running 4 nodes, with replication fac... by guilmxm Influencer in Deployment Architecture 07-26-2017 1 5	1	5
Indexer cluster from non clustered indexer Hello, I have an instance with indexer and Search head in the same instance. I was asked to create a cluster of ind... by noybin Communicator in Deployment Architecture 07-26-2017 0 3	0	3
How to perform maintenance on entire search head clusters ? Hello Techies !! I have to take snapshots of the EBS volumes that are attached to the cluster search heads, I have t... by vgollapudi Communicator in Deployment Architecture 07-25-2017 0 4	0	4
FEATURE REQUEST: Rebalance buckets across new and existing indexers I am hoping this will be added to a future release and can happen in real time and/or a maintenance mode for the inde... by bandit Motivator in Deployment Architecture 07-25-2017 30 6	30	6
In an indexer cluster, if one indexer goes down, will any replicated bucket not be used in search? We are on Splunk 6.6.2. We presently used indexer clustering. We have 2 indexers. The status of our cluster is: all ... by brdr Contributor in Deployment Architecture 07-25-2017 0 1	0	1
How to Check Server availablilty Can someone tell me the best way to use splunk to check if a server is available. I am new at Splunk and would like t... by mzemcik New Member in Deployment Architecture 07-25-2017 0 2	0	2
Getting this message on Splunk Web : FAILED_LOAD_DEPLOYMENT_SERVER Getting the below message post upgrade from 5.0.8 to 6.1.4 : FAILED_LOAD_DEPLOYMENT_SERVER. ,please let me know ho... by bhavesh91 New Member in Deployment Architecture 07-24-2017 0 9	0	9
New Splunk Cloud Trial - Cannot use Csharp Logger to send data I created a new Splunk Cloud trial account today to evaluate it for my team. After a lot of playing around it appear... by aidanmorgan New Member in Deployment Architecture 07-21-2017 0 3	0	3
Download HUNK Hi Team, For POC I need to Setup a Hunk environment, Deploy Hunk connect it to MySQL, create a simple Employee schem... by sridath New Member in Deployment Architecture 07-21-2017 0 1	0	1
Deployment server connectivity issue ? HI All, After recent upgrade to the latest splunk version 6.6.1 we could see some of the splunk agent throwing some e... by Hemnaath Motivator in Deployment Architecture 07-21-2017 0 3	0	3
How to set up a search head and indexer clustering from a standalone setup? Hi, My current Splunk setup is 1- stand alone search 1 - master node 3 - indexer(clustering) Future Splunk setup ... by yuvarajan1989 New Member in Deployment Architecture 07-20-2017 0 3	0	3
Webconsole for indexers not accesible We have two indexers and i want to enable webconsole for them and I enabled webserver console using the command ./spl... by hrithiktej Communicator in Deployment Architecture 07-20-2017 0 3	0	3
DMC vs Deployment server - different number of forwarders Hi Splunkers, I have noticed my DMC shows around 1450 forwarders (180 of which are missing) but my Deployment Sever... by Robbie1194 Communicator in Deployment Architecture 07-19-2017 0 1	0	1
Deployment Server, No web port access. Remotely pull info? We have two deployment servers that live in DMZ's. For this reason I am not allowed access to the web port from my lo... by JDukeSplunk Builder in Deployment Architecture 07-17-2017 0 3	0	3
Unable to remove Search Peer from Search Head Just recently enabled HTTPs in my environment. I was able to remove and re add search peers to 2 other search heads ... by cburgman Path Finder in Deployment Architecture 07-17-2017 0 1	0	1
How to access POOL_SIZE from non-license master? Hi, I had some license reports running on our license manager, and now I've been asked to put them on the customer s... by a212830 Champion in Deployment Architecture 07-17-2017 0 5	0	5
how to roll hot bucket to warm at specific time intervals? I want to change time of buckets transitions from hot to warm or warm to cold etc. by gizemk00 Engager in Deployment Architecture 07-17-2017 0 4	0	4
Do I need a Heavy Forwarder if I'm monitoring Active Directory and DHCP logs? Hi Ninjas, Just like to ask if I still need to have a Heavy Forwarder in monitoring AD and DHCP logs? Or Universal F... by dantimola Communicator in Deployment Architecture 07-17-2017 0 1	0	1