Deployment Architecture

Community Activity

Deployment Server, No web port access. Remotely pull info? We have two deployment servers that live in DMZ's. For this reason I am not allowed access to the web port from my lo... by JDukeSplunk Builder in Deployment Architecture 07-17-2017 0 3	0	3
Unable to remove Search Peer from Search Head Just recently enabled HTTPs in my environment. I was able to remove and re add search peers to 2 other search heads ... by cburgman Path Finder in Deployment Architecture 07-17-2017 0 1	0	1
How to access POOL_SIZE from non-license master? Hi, I had some license reports running on our license manager, and now I've been asked to put them on the customer s... by a212830 Champion in Deployment Architecture 07-17-2017 0 5	0	5
how to roll hot bucket to warm at specific time intervals? I want to change time of buckets transitions from hot to warm or warm to cold etc. by gizemk00 Engager in Deployment Architecture 07-17-2017 0 4	0	4
Do I need a Heavy Forwarder if I'm monitoring Active Directory and DHCP logs? Hi Ninjas, Just like to ask if I still need to have a Heavy Forwarder in monitoring AD and DHCP logs? Or Universal F... by dantimola Communicator in Deployment Architecture 07-17-2017 0 1	0	1
What is the best way to handle deploying saved searches to multiple search heads? Currently I have 4 search heads and 1 deployment server. The search heads are not clustered. I am not able to find ... by ss250858 Observer in Deployment Architecture 07-16-2017 0 4	0	4
Universal / Heavy Forward Vs Http Event Collector hi, My requirement is to push a continuous stream of data into Splunk for search and reporting. Data will be provided... by nks New Member in Deployment Architecture 07-16-2017 0 2	0	2
how to push KVSTORE data from search head to SQL DB Hi Can any one help me in pushing KVstore data from Search head to SQL data base. curently KV store data is on Sear... by cleelakrishna Loves-to-Learn in Deployment Architecture 07-16-2017 0 2	0	2
Deployment Server Whitelist help I have n number of hosts with below pattern. hostname01.corp.domain.com hostname02.corp.domain.com hostname03.cor... by splunkIT Splunk Employee in Deployment Architecture 07-14-2017 0 2	0	2
Did the _time value change for bin or bucket? When we started using Splunk a couple of years ago, we needed to calculate mean on various time windows (5, 20, 60) m... by nmaiorana Explorer in Deployment Architecture 07-14-2017 0 1	0	1
Data loss HF goes down Our set up- HF receives syslog (directly from firewalls, IPS, etc) and logs from UF (windows and linux machines) an... by hkumar26 New Member in Deployment Architecture 07-14-2017 0 3	0	3
Why some of our universal forwarder intermittently stops forwarding logs? Hi All, Good day, would like to seek for help regarding on our universal forwarders. Some of our sources (universal ... by dantimola Communicator in Deployment Architecture 07-13-2017 0 2	0	2
What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? What is the best order to perform the above? Our current Splunk environment consists of 5 clustered Indexers and 4 c... by lawannapage New Member in Deployment Architecture 07-13-2017 0 5	0	5
How to forward data to unsplunk system? I have configured three files outputs.conf, transforms.conf and props.conf but still I am not getting forwarded data ... by niveditahanuman New Member in Deployment Architecture 07-13-2017 0 2	0	2
What does archivebuckets do on a heavyforwarder? Hi all We are running Splunk on a distributed environment. We have an Index Cluster (8 nodes). Also on each system i... by Muryoutaisuu Communicator in Deployment Architecture 07-11-2017 0 2	0	2
How to fix the searches across the reduced buckets issue for a particular index ? Hi All, Currently we are facing an issue while performing a search against a particular index and found it was due to... by Hemnaath Motivator in Deployment Architecture 07-11-2017 0 4	0	4
Deployment server Restart Do we need to restart Deployment server if we make any changes in Splunk\etc\apps\local\inputs.conf(xyz) and \Splunk\... by rangineniarunku Explorer in Deployment Architecture 07-11-2017 0 2	0	2
how to find out if all our search heads in search head cluster environment is in sync? Hello, We are running 6.3.3 with search head clustering and 4 search heads in the cluster. Some times users complain... by sim_tcr Communicator in Deployment Architecture 07-11-2017 0 3	0	3
Finding forwarders that are not reporting in but have in the past Hi guys, I've been been given 2 tasks with regards to our Splunk forwarders. 1) Find out which forwarders are not... by Robbie1194 Communicator in Deployment Architecture 07-10-2017 0 2	0	2
Does Splunk support two search head clusters with one indexer cluster? Does Splunk support two search head clusters with one indexer cluster? Basically we have 3 search heads clustered. we... by ankithreddy777 Contributor in Deployment Architecture 07-08-2017 1 3	1	3
Adding new SH cluster to existing splunk setup. Currently we have 1 multisite indexing cluster, 1 multisite search head cluster, a deployer and a master node. Planni... by sajeshpp Path Finder in Deployment Architecture 07-08-2017 0 2	0	2
How to calculate dispatch directory size in Splunk? Hi, I want to calculate dispatch directory size in Splunk to help in Splunk performance monitoring. Can anyone pleas... by MousumiChowdhur Contributor in Deployment Architecture 07-06-2017 0 1	0	1
Is it possible to bring new servers online into the respective pools and have them sync in such a way that we can remove the old servers one at a time? Would it be possible to bring the new servers online into the respective pools and have them sync in such a way that ... by trinity1571 New Member in Deployment Architecture 07-06-2017 0 3	0	3
How to configure Universal Forwarder to receive UDP traffic I am trying to forward events from my current SIEM to the Universal forwarder using UDP and port 9514. When I run a t... by pfabrizi Path Finder in Deployment Architecture 07-05-2017 0 7	0	7
Best practices to send multiple devices to a single indexer via syslog We have a deployment with approximately 500 linux systems that are sending logs via syslog on a single indexer. In so... by lightech1 Path Finder in Deployment Architecture 07-04-2017 0 6	0	6