Deployment Architecture

Discussions

Thread Info

Indexer Clustering - assertion crash on downloading bundle?

While upgrading a cluster to a newer version, I upgraded the Cluster Master first. and then pushed out a bundle. Imme...

by Splunk Employee in

How to configure search head clustering in multisite environment

I had setup multisite cluster 6.2.1. Details of my Splunk environment are mentioned below We have two sites Master...

by Communicator in

In an HEC environment, how would you copy a log stream to an external destination?

We have a need to have all log data coming into an index copied off to another logging system. The index is being fed...

by Influencer in

Can we distribute data inputs in splunk?

Hi, I have set up Index peering cluster, where one node is index cluster master and rest two nodes are peer nodes....

by Explorer in

How to backup all data Splunk has indexed?

Hi everyone! I would like to do a quick and dirty backup of all of my data Splunk has ever indexed. Am I fine to s...

by Explorer in

Is there a smart way of cleaning event data from an index on a regular basis in a multisite indexer clustering environment?

Hi All, I have 4 Indexer Servers, 2 per each Site. Site1 has 2 and Site2 has 2 servers in each. All these 4 server...

by Motivator in

How can we indetify indexes which get currently lots of DEBUG events?

We got a license warning yesterday and we are pretty sure it's due to excessive DEBUG events coming through. Is it po...

by Ultra Champion in

File growth rate must be higher than indexing or forwarding rate.

03-19-2014 18:47:22.017 -0500 INFO BatchReader - Will retry path="\servername1\dnsdebug\dns.log" after deferring for ...

by Path Finder in

How to resolve error "A script exited abnormally" after updating serverclass.conf?

Hi All, Can anyone guide us in how to fix this problem? We updated the serverclass.conf recently via deployment serve...

by Motivator in

Upgrade all universal forwarders using deployment servers. Is it possible as of 6.0.2?

we're having problems with a splunk bug (SPL-78457) and we need to upgrade our 128+ universal forwarders (linux+solar...

by Communicator in

Splunk Enterprise Security Search Head returning dual events

We are using Splunk 6.5 environment with 5 (4+1) Search Heads where the latest SH is dedicated for Enterprise Securit...

by Path Finder in

monitor particular log in universal forwarder

Hi all, How do we monitor one particular log through universal forwarder because we are writing 10 different logs ...

by Communicator in

Splunk DBX v1.0.9 Java Bridge Server not running

Greetings Splunk Answers, I recently upgraded from Splunk DB Connect 1.0.8 to 1.0.9 and am now experiencing an iss...

by Explorer in

auditd.conf

I want to send auditd.conf files to the splunk server so I can monitor when an account is created and deleted on one ...

by Path Finder in

[Index Cluster] How CM in Indexer Clustering decide SH as down, and how we can tune configuration just like for Cluster Peers?

CM proclaims a SH is down if it misses 2x generation_poll_interval (set on the SH) setting: server.conf 299 #only ...

by Splunk Employee in

How does a Search Head Cluster determine if a restart is necessary when a configuration bundle is applied?

A configuration bundle can be applied to a Search Head Cluster (SHC) from a Deployer with the command: splunk appl...

by SplunkTrust in

POLL: How often do you update your Splunk Enterprise software in production?

We are having an internal debate concerning the frequency with which we should update our Splunk Enterprise software ...

by Path Finder in

Gone part of the event when indexing

Hello. We have a problem with the event handling in splunk. We get events from AWS S3 and one of the events are index...

by Explorer in

Splunk Enterprise POC - Architecture: Is it possible to install a forwarder, indexer, and search head on one Linux box?

Hi, I am well trained in Splunk Dashboarding. I would like to try out a POC of the Splunk Enterprise with the belo...

by Path Finder in

Why is the search head distributing entire knowledge bundle 50+ times an hour and doesn't appear to be sending .delta files instead?

While digging through my Search head logs, I stumbled upon some WARN messages from the DistributedBundleReplicationMa...

by Path Finder in

How to match all hosts in props.conf?

I'm looking to match and filter upcoming events of all hosts. Under SPLUNK_HOME\etc\apps\search\local\props.conf, I t...

by Communicator in

I received a new release available notification on my search head. Where does the notification come from?

Hello, When connecting to my search head, I got a notification about a new release being available. However my ...

by Communicator in

MAX_EVENTS setting on indexer not working

Hi, We have a cluster setup - where we have 1. Heavy Forwarders 2. Indexer servers and an indexer master 3. Search...

by Path Finder in

Why is backfilled summary index data not showing?

I run the following search on the search head and receive results that I expect: index=c_metrics Severity!="Very L...

by Contributor in

After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

What conf file controls the below message? I noticed the following warning message after upgrading my deployment serv...

by Path Finder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Indexer Clustering - assertion crash on downloading bundle?

How to configure search head clustering in multisite environment

In an HEC environment, how would you copy a log stream to an external destination?

Can we distribute data inputs in splunk?

How to backup all data Splunk has indexed?

Is there a smart way of cleaning event data from an index on a regular basis in a multisite indexer clustering environment?

How can we indetify indexes which get currently lots of DEBUG events?

File growth rate must be higher than indexing or forwarding rate.

How to resolve error "A script exited abnormally" after updating serverclass.conf?

Upgrade all universal forwarders using deployment servers. Is it possible as of 6.0.2?

Splunk Enterprise Security Search Head returning dual events

monitor particular log in universal forwarder

Splunk DBX v1.0.9 Java Bridge Server not running

auditd.conf

[Index Cluster] How CM in Indexer Clustering decide SH as down, and how we can tune configuration just like for Cluster Peers?

How does a Search Head Cluster determine if a restart is necessary when a configuration bundle is applied?

POLL: How often do you update your Splunk Enterprise software in production?

Gone part of the event when indexing

Splunk Enterprise POC - Architecture: Is it possible to install a forwarder, indexer, and search head on one Linux box?

Why is the search head distributing entire knowledge bundle 50+ times an hour and doesn't appear to be sending .delta files instead?

How to match all hosts in props.conf?

I received a new release available notification on my search head. Where does the notification come from?

MAX_EVENTS setting on indexer not working

Why is backfilled summary index data not showing?

After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

Enterprise Security Content Update (ESCU) | New Releases

Index This | Divide 100 by half. What do you get?

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

Setup Splunk on AWS Elastic Beanstalk

Splunk Intermediate Forwarder Setup

CMMC Version 2.0

Stream forwarder only works when running as root

Search Cluster Overwriting etc/system/local/inputs...