Deployment Architecture

Community Activity

Can two clusters be merged? For Enterprise deployment planning purposes, is it possible to merge two individual clusters into a single combined c... by Lowell Super Champion in Deployment Architecture 05-16-2017 2 2	2	2
Automatic procedure to handle 2 active-passive cluster masters Hi, we're about to deploy a new multi-site Splunk infrastructure. We're talking of 4 SHs, 40 IDXs, 10 HFWs and 2 clu... by stefano_guidoba Communicator in Deployment Architecture 05-15-2017 0 2	0	2
How to remove .svn directory from deployed apps? We're looking to place our deployment-apps folder on the Splunk deployment server under version control. We're planni... by scsvnovonordisk New Member in Deployment Architecture 05-12-2017 0 7	0	7
How do I Secure SplunkWeb on a Search Head Cluster I am working on securing our Splunk environment. I'm starting with the Splunk Web parts. I have a few non-clustered S... by sniderwj Explorer in Deployment Architecture 05-12-2017 0 7	0	7
What is the Best practice for stateOnClient parameter on deployment-server and clients ? hi folks just wanted to get your view on large scale installations of Universal Forwarders and apps in them. What do ... by koshyk Super Champion in Deployment Architecture 05-12-2017 0 3	0	3
How does a Splunk cluster replicate data across data centers? Does anyone know how splunk cluster does replication? Specifically, synchronously or asynchronously? The reason I am... by xchang1226 Path Finder in Deployment Architecture 05-12-2017 2 2	2	2
Splunk data retention policy: What is the best way to reconfigure our site's retention policy to ensure backups are taking place? So I have taken over as the Splunk administrator for Splunk Enterprise from a colleague that has left the business. H... by jrwebst Explorer in Deployment Architecture 05-11-2017 0 4	0	4
What does this warning mean? Warning of the form "WARN CMRepJob - _rc=0 statusCode=500 err=No error" in splunkd.log. Found on the cluster master o... by bohanlon_splunk Splunk Employee in Deployment Architecture 05-11-2017 0 1	0	1
In a SHC; how can I retrieve on which search head I am working? I've installed a search head cluster with four nodes. How can I retrieve from the web GUI on which specific node (lik... by niek33 Engager in Deployment Architecture 05-10-2017 0 1	0	1
about adding indexers and search header questions. 1、"Index" is my master node, why does it appear on my search head list? I try to type "splunk remove shcluster-member... by xsstest Communicator in Deployment Architecture 05-10-2017 0 4	0	4
bucket roll logging Hi, does Splunk logs somewhere internal how / when buckets are rolled, e.g. from cold to frozen? reason: frozen b... by maada Explorer in Deployment Architecture 05-10-2017 1 3	1	3
What does CMTruncJob mean in indexer clustering? Anyone can point me to docs that describe under what circumstances the cluster master will issue bucket truncation jo... by rbal_splunk Splunk Employee in Deployment Architecture 05-09-2017 0 1	0	1
how do I extract the last value from different source in the same table Hello! How do I extract the last time event from two different source in the same table! example for just one event... by danielgp89 Path Finder in Deployment Architecture 05-09-2017 0 6	0	6
how to use maxDataSize to control the size of each bucket I use maxDataSize to control the size of each bucket. The purpose is to limit each bucket up to 6MB. Join "maxDataSiz... by jek01 New Member in Deployment Architecture 05-08-2017 0 4	0	4
How to identify Splunk Instance role by internal logs? Hi there, prologue: in my clustered environment i have a search head which is dedicated to a special user group an... by swe Path Finder in Deployment Architecture 05-08-2017 0 7	0	7
How to index log file from 50 servers Hi, There are around 50 servers for which log files are in same format... I want to track current server status, num... by k_harini Communicator in Deployment Architecture 05-07-2017 0 1	0	1
Bucket files in Splunk & its file format. How to delete Hi All, Deleting the bucket being the only way out to reclaim space, I have some queries on buckets. All I have is "... by dhsetty Explorer in Deployment Architecture 05-05-2017 0 1	0	1
delete/clean data for a specific time period Need help for cleaning/deleting data for a particular time period. Data need to be permanently removed along with cle... by dhsetty Explorer in Deployment Architecture 05-05-2017 0 12	0	12
Why does "splunk show shcluster-status" show "last_conf_replication: Pending" after upgrade from 6.3.2 to 6.5.0? Hi Recently I upgraded my Splunk environment from 6.3.2 to 6.5.0. The environment has a search head cluster, an inde... by daniel_kwok72 Explorer in Deployment Architecture 05-05-2017 1 5	1	5
Search query to check selective forwarders phoning home status from thousands of forwarders. We have thousands of forwarders installed. Our requirement is to check status of only 50-100 forwarders from thousand... by onkarkore1 Explorer in Deployment Architecture 05-04-2017 0 1	0	1
A difficult question，How to create an alert on a Splunk cluster？ Hi at all, I created a Splunk cluster, created an alert on the main search, but I could not find it in the alert, I... by xsstest Communicator in Deployment Architecture 05-04-2017 0 18	0	18
Saved search changes in search head cluster don't persist. We have some scheduled saved searches that we migrated from a stand-alone SH to a SHC via a deployer. When we try an... by t183194 Explorer in Deployment Architecture 05-04-2017 0 5	0	5
Hotdata running the out of disk space Hi Folks, We have indexer and the hotdata volume is running the out of disk space. we don't have option reduce froze... by lksridhar Explorer in Deployment Architecture 05-04-2017 0 2	0	2
splunk edit user admin clears admin password instead of changing it I found this answer about changing the admin password in splunk (I am using splunkforwarder 4.5.2 actually): https:/... by wsanderstii Path Finder in Deployment Architecture 05-04-2017 1 2	1	2
Use summary index in join statement Hi, I have a query which looks like this: Search 1 \| fields userID, logonID \| join logonID [Search 2 \| fie... by deepak02 Path Finder in Deployment Architecture 05-04-2017 0 5	0	5