Deployment Architecture

Discussions

Thread Info

Schedule a saved search to run a designated Search Head

Hi, Assuming I have 4 search heads (A, B, C, D) on a cluster env. Is it possible to schedule a saved search to run a ...

by Builder in

Summary index cron schedule to populate first then schedule

Hi, I am creating a new summary index and scheduled it to run every 6 hours intervals. In savedsearches.conf, put ...

by New Member in

Splunk how to filter today and yesterday logs? what's CLI command?

I will filter today and yesterday logs on splunk,but i don't konw what's command? can you tell me? thank you

by New Member in

Problem trying to use deployment-apps

I am fresh to Splunk Enterprise so I must be missing something simple. To summarize: what does a deployment applicati...

by Explorer in

How to take down network attached cold storage for multiple indexers?

In our clustered indexers, the cold storage is "network attached". There is a software upgrade for the storage platfo...

by Super Champion in

Is there a way to only use DNS to connect to a search head?

I have two ways to connect to a search head, and 1 is secured with SSL, while the other is not. 1: https://ip:por...

by Motivator in

splunk deployment

I am going to be using splunk deployment server for the first time in our environment to deploy some changes into inp...

by Path Finder in

When I restore a frozen bucket, can I select which index it will be restored to?

I've read this article which tells me how to restore a frozen bucket. http://docs.splunk.com/Documentation/Splunk/6.5...

by New Member in

Install app/add-on in a clustered Search head?

Hi All, I did go through the docs and installed the Kafka add-on via the Deployer in a Search head cluster. I copi...

by Communicator in

Currently audit_db, access_summarydb are consuming space in PCI Search Head. How do I find the indexes.conf file and its configurations?

Hi All, Currently we have noticed under this path /opt/splunk/var/lib/splunk/ audit_db & access_summarydb has occupie...

by Motivator in

How to verify whether configuration files are pushed correctly from the deployment server?

Hi there, Can i please know how to check whether the configuration file is pushed correctly from the deployment se...

by Path Finder in

Splunk _internal logs consuming license?

Hi Team, I have 5 GB enterprise license.We have created 8 indexes in splunk. From few days there were no data obse...

by New Member in

I want to increase base_max_searches in limits.conf, but what is MAX recommended value for this setting?

I have 4 indexers and 3 search heads and I currently have a */local/limits.conf file as below for my SH settings: ...

by New Member in

Cloud splunk-S3 bucket Failed to collect s3 data

Hi all , I have configured my splunk- aws add on and aws app . But I am getting the following error in /opt/splunk/v...

by New Member in

Cap daily indexation of an index

Hello, We currently have an index that has a size ranging from 3 to 7 Go per day, is there any way to limit the da...

by Explorer in

Is it possible limit user access to an index on a Search Head level?

Use case: A customer runs his personal Search Head but we only want to give him access to certain indexes Since we...

by Communicator in

Monitoring csv file using Universal forwarder missing some data into index

I have Task Scheduler which runs for every 6 hours and generates .csv file into a folder, I am monitoring this file u...

by Explorer in

Using different Splunk Version for Search Head Cluster as for the Indexer Cluster

Hi ninjas I wonder wheter if it is supported having different splunk versions of the indexer cluster and the search h...

by Path Finder in

Splunk Web does not restart with bucket restore

Hello, When restoring buckets to thawedb, Splunk Web does not want to restart. Here is the procedure: A Warm...

by Explorer in

How to manage the size of .delta and .bundle files?

Hi Team, What need to be blacklisted so that the size of .delta and .bundle files will be controlled as the size i...

by Explorer in

How to add condition in splunk data model constraint

I have a outbound flow that gets data written by App, mem and cards api. cards and mem api is writing logs into applo...

by Explorer in

Why is splunkd.log not getting indexed? Receiving error "The file 'E:\Splunk\var\log\splunk\splunkd.log' is invalid. Reason: binary"

My splunkd.log is being flooded with the following messages over and over - 01-04-2017 01:05:31.133 -0600 WARN Fi...

by Contributor in

Help with a DevOps deployment: Why am I receiving results from all indexes except main ("waiting for data" message displayed)?

Hi All, Really need a Jedi to help me get my DevOps instance running again. I have a security appliance sending lo...

by Contributor in

How to set the “sensitivity” of indexer clustering to 0.95 or 1.0?

Hey guys, How can I change the default of 0.8 or 0.7 to 0.95 or 1.0 for sensitivity in the cluster. I need to ...

by Contributor in

How to upgrade a Splunk search head and indexer cluster from 6.3.2 to 6.5.1?

Hi We are doing upgrade from 6.3.2 to 6.5.1. We have a search head cluster and indexer cluster in our Splunk setu...

by Builder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Schedule a saved search to run a designated Search Head

Summary index cron schedule to populate first then schedule

Splunk how to filter today and yesterday logs? what's CLI command?

Problem trying to use deployment-apps

How to take down network attached cold storage for multiple indexers?

Is there a way to only use DNS to connect to a search head?

splunk deployment

When I restore a frozen bucket, can I select which index it will be restored to?

Install app/add-on in a clustered Search head?

Currently audit_db, access_summarydb are consuming space in PCI Search Head. How do I find the indexes.conf file and its configurations?

How to verify whether configuration files are pushed correctly from the deployment server?

Splunk _internal logs consuming license?

I want to increase base_max_searches in limits.conf, but what is MAX recommended value for this setting?

Cloud splunk-S3 bucket Failed to collect s3 data

Cap daily indexation of an index

Is it possible limit user access to an index on a Search Head level?

Monitoring csv file using Universal forwarder missing some data into index

Using different Splunk Version for Search Head Cluster as for the Indexer Cluster

Splunk Web does not restart with bucket restore

How to manage the size of .delta and .bundle files?

How to add condition in splunk data model constraint

Why is splunkd.log not getting indexed? Receiving error "The file 'E:\Splunk\var\log\splunk\splunkd.log' is invalid. Reason: binary"

Help with a DevOps deployment: Why am I receiving results from all indexes except main ("waiting for data" message displayed)?

How to set the “sensitivity” of indexer clustering to 0.95 or 1.0?

How to upgrade a Splunk search head and indexer cluster from 6.3.2 to 6.5.1?

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

Search results differ between real-time search and...

Setup Splunk on AWS Elastic Beanstalk

Splunk Intermediate Forwarder Setup

CMMC Version 2.0

Stream forwarder only works when running as root