Deployment Architecture

Community Activity

Has anyone seen search returning different numbers of events after upgrading to 6.6.0? I upgraded our DMC (Distributed Management Console) to 6.6.0 last week, but everything else in our environment is sti... by lycollicott Motivator in Deployment Architecture 05-24-2017 0 1	0	1
How do you add additional deployed forwarders to existing server classes? I have a server class called DomainControllers, and have 2 existing DCs that were added when I initially created the ... by systemsadminist Explorer in Deployment Architecture 05-24-2017 0 4	0	4
json sourcetype failed to act correctly hi everyone i have a problem with events with sourcetype=json. when i send several logs to splunk in json format less... by fatemebayat Engager in Deployment Architecture 05-24-2017 0 2	0	2
Splunk forwarder indexer communication How can splunk indexer avoid from receiving data, if a hacker is sending corrupt data from his local system through u... by rangineniarunku Explorer in Deployment Architecture 05-23-2017 0 2	0	2
Trouble ingesting multi line VB script output Currently we are using VB scripts to query the WMI namespace within windows for data collection I have written a simp... by JamesRConley Explorer in Deployment Architecture 05-23-2017 0 3	0	3
Why is a Search Head Cluster Member not replicating all changes? We recently added a new member to our search head cluster and upon changing the captain once adding the new member ha... by mdsnmss SplunkTrust in Deployment Architecture 05-23-2017 0 2	0	2
splunk logging driver for docker Hi i am trying to run docker with splunk logging driver . I am using splunk cloud managed service . I am receiving ... by vvelpuri Explorer in Deployment Architecture 05-23-2017 1 4	1	4
can a HF be a deployment server & client ? In a scenario where we have 2 x HF's that send data to a cloud instance. One of the HF's is a deployment server - ca... by Esky73 Builder in Deployment Architecture 05-23-2017 1 6	1	6
Are there performance issues for increasing the "max_searches_per_CPU" setting in limits.conf to accommodate more historical concurrent searches? I have 16 core CPU on search head which accommodate 22 concurrent searches by default. When 22 concurrent searches is... by ankithreddy777 Contributor in Deployment Architecture 05-22-2017 0 1	0	1
Splunk License Master and Heavy Forwarder communicate Hello, does anyone know if there is any communication between License Master and Heavy Forwarder initiated by the Li... by AlesFrohlich Explorer in Deployment Architecture 05-21-2017 0 3	0	3
Can I migrate to a new Splunk server without re-configuring forwarders? I'd like to change my Splunk server to a different Linux distribution from Fedora to Centos. Indexer, search head an... by bayman Path Finder in Deployment Architecture 05-19-2017 0 7	0	7
Why am I getting a warning from my search head cluster captian stating "unable to distribute to peer"? I'm attempting to convert from a search head (sh) pool to a search head cluster. All instances (cluster master, index... by w199284 Explorer in Deployment Architecture 05-19-2017 0 2	0	2
Splunk Deplyoment server and Vcentr utlizing the same port (8089) We have a huge amount of client server reporting to the deployment server using the port 8089. is there a way to chan... by muthu285kumar New Member in Deployment Architecture 05-19-2017 0 1	0	1
I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined. Well I thought it was odd, anyway. I have a serverclass called "Lar Test" and it has three apps assigned to it. I ... by lycollicott Motivator in Deployment Architecture 05-19-2017 1 2	1	2
Indexer : coldToFrozenScript Could not look up HOME variable The error below just started showing up in the splunkd.log. Not sure why. We have 2 indexers. This error is only show... by brdr Contributor in Deployment Architecture 05-19-2017 0 1	0	1
Where the logs for runtime search errors and search response times are stored? Hi, I am still relatively new to Splunk. I'm trying to analyze the splunk internal logs. I am currently trying to fi... by mngeow Engager in Deployment Architecture 05-19-2017 0 1	0	1
What certificates are used for hybrid search communication between an on-premise search head and Splunk Cloud clustered indexers and master node? Per the Splunk Cloud documentation, it is possible to have a Hybrid Search model where an on-premise Search Head esse... by pj Contributor in Deployment Architecture 05-18-2017 0 1	0	1
After deploying apps using the Deployment Server, does Splunk restart all of them at once? We are just starting to use Deployment Server. Most of my apps are for inputs.conf and outputs.conf configurations. ... by aferone Builder in Deployment Architecture 05-18-2017 0 2	0	2
After upgrading to Splunk 6.6.0, why are 5 indexes marked as not searchable? After an upgrade of our small cluster (two indexers, one search head, RF=SF=2) to 6.6.0, 5 indexes are marked as not... by sylim_splunk Splunk Employee in Deployment Architecture 05-17-2017 0 1	0	1
New index not showing in admin console I created a bunch of new, custom indexes (i.e. index=myApp) that go to a new path and restarted the indexers. The pa... by Sageth New Member in Deployment Architecture 05-17-2017 0 5	0	5
Scheduled shell-script to copy data like csv-files with splunk Hallo, i want to execute daily a shell-script, that copys data to the csv-dir from Splunk. Is it a good way to do ... by gerdhuber Explorer in Deployment Architecture 05-17-2017 0 3	0	3
Container logs aggregation using Splunk I have say 20 containers how do i forward the individual containers logs to Splunk , do i need to install forwarders... by pradiptam Explorer in Deployment Architecture 05-17-2017 0 8	0	8
Can two clusters be merged? For Enterprise deployment planning purposes, is it possible to merge two individual clusters into a single combined c... by Lowell Super Champion in Deployment Architecture 05-16-2017 2 2	2	2
Automatic procedure to handle 2 active-passive cluster masters Hi, we're about to deploy a new multi-site Splunk infrastructure. We're talking of 4 SHs, 40 IDXs, 10 HFWs and 2 clu... by stefano_guidoba Communicator in Deployment Architecture 05-15-2017 0 2	0	2
How to remove .svn directory from deployed apps? We're looking to place our deployment-apps folder on the Splunk deployment server under version control. We're planni... by scsvnovonordisk New Member in Deployment Architecture 05-12-2017 0 7	0	7