Deployment Architecture

Community Activity

Can Search head members and deployer run on same lb Can the deployer and search head cluster members run on the same load balancer? I have a load balancer and the pool m... by dhawal_sanghvi New Member in Deployment Architecture 04-03-2017 0 3	0	3
send data from heavy forwarder to peer index Hello, I need to send specify log file data from HF to a specify index on peer. bash-4.2$ more inputs.conf [monitor... by Prakhar_shukla Path Finder in Deployment Architecture 04-02-2017 0 5	0	5
Event sent to null queues I have merged several lines in to one event using Should_linemerge=true. Now event looks like abc bcd cde efg I wan... by ankithreddy777 Contributor in Deployment Architecture 03-31-2017 0 2	0	2
Setting outputs.conf I have a doubt here..I want to index data to both sandbox and production. What changes do I need to make here. [tcpo... by rangineniarunku Explorer in Deployment Architecture 03-31-2017 0 1	0	1
Forwarder stopped pushing performance data Hi, I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data... by siddharthmis Explorer in Deployment Architecture 03-31-2017 0 6	0	6
Universal Forwarder for Windows Server 2003 64 bit DC version I am needing a universal forwarder for Windows Server 2003 64 bit DC. Which version would work with this OS? by kekac00 Explorer in Deployment Architecture 03-30-2017 0 1	0	1
Splunk CRC check I have one log file at particular path on server1. I am forwarding it to splunk index=index1. I have another log fil... by ankithreddy777 Contributor in Deployment Architecture 03-30-2017 0 1	0	1
Importing .SPL project into Search head cluestering Hi Splunk Experts, Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, ... by dhawal_sanghvi New Member in Deployment Architecture 03-30-2017 0 5	0	5
Configure Splunk to ignore logs from some VMs on the same physical host Hi, I have a setup (shown in pics) in which a bunch of forwarders are sending data to Splunk. One of the forwarders ... by namrithadeepak Path Finder in Deployment Architecture 03-30-2017 0 7	0	7
Bin limits? I'm running a search over two sourcetypes - an inputlookup (contains metadata about the pdf) and the log file (contai... by mistydennis Communicator in Deployment Architecture 03-29-2017 0 2	0	2
Deployment Server / Client Setup I am trying to setup a deployment server on an indexer that we are using. So far, this is what I have done: On the... by tmarlette Motivator in Deployment Architecture 03-29-2017 0 3	0	3
Why are search head hosts unable to connect to master indexer? I'm setting up some hosts to become a search head cluster to be joined with an indexer cluster. There are five hosts... by scottj1y Path Finder in Deployment Architecture 03-29-2017 0 7	0	7
The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but it is missing the 'multisite' attribute' for master=https://127.0.0.1:8990 Does anyone know how this can be fixed? Thanks. by jackiewkc Path Finder in Deployment Architecture 03-29-2017 1 9	1	9
Can I safely remove old cluster remote-bundle directories to free up disk space? I am using up a lot of disk space under ${SPLUNK_HOME}/var/run/splunk/cluster/remote-bundle on our Cluster Manager/Ma... by datajock Explorer in Deployment Architecture 03-29-2017 3 6	3	6
Troubleshooting Splunk Forwarder (suddenly stopped) Hi, I had installed a Splunk forwarder alongside an application server. The Splunk forwarder stopped all of a sudden... by namrithadeepak Path Finder in Deployment Architecture 03-28-2017 0 2	0	2
Why is a standalone search head getting duplicate events? We have had a Standalone Search Head that has been getting duplicate events for all searches. He have found the cause... by cpetterborg SplunkTrust in Deployment Architecture 03-28-2017 1 3	1	3
Splunk Heavy Forwarder with NFS shares Hi all, I have a question regarding log indexing on an NFS share. The problem we have is, that this NFS share is co... by simony Path Finder in Deployment Architecture 03-28-2017 0 3	0	3
Store everyday data into spreadsheet (Append data on date wise) Hi, Splunk query the indexed iis data and generate the report on daily basis. Is it possible to append each and every... by guruwells Explorer in Deployment Architecture 03-28-2017 0 5	0	5
Issue Forwarding Cloud Custodian Logs Using a Splunk Universal Forwarder I have a developer running Cloud Custodian scans in AWS and dropping the JSON results on a Linux box running a Splunk... by gerrykahn Explorer in Deployment Architecture 03-28-2017 0 5	0	5
Forwarder suddenly stopped forwarding Hi, I configured a universal forwarder to send data to 4 indexers. It was working alright until it stopped logging l... by deepak02 Path Finder in Deployment Architecture 03-27-2017 1 6	1	6
Changing an existing Splunk Forwarder into a deployment client I have an existing Splunk Forwarder currently forwarding data to an indexer. I have a new deployment server I want t... by himynamesdave Contributor in Deployment Architecture 03-27-2017 0 6	0	6
Why changing forwarder to deployment client changes host? RE: I recently switched our forwarders from being individually managed to deployment clients (as per question here)... by himynamesdave Contributor in Deployment Architecture 03-27-2017 0 2	0	2
Can anyone help me understand "genid thats invalid or out of range" and "Proxy is in disconnect state" warning messages from my indexer cluster? We have an indexer which is going to be down for several days, so in preparation for that I performed these steps: s... by lycollicott Motivator in Deployment Architecture 03-27-2017 0 2	0	2
How to remove a search head from the cluster when the VM is already deleted? Hi, We had some search heads in a cluster, running on VMs. A couple of the VMs were deleted without properly removin... by hettervik SplunkTrust in Deployment Architecture 03-27-2017 0 8	0	8
Remove reference to host in mongodb Hi, we have a search head cluster where a couple of the search heads where removed by shutting down the VMs. In othe... by hettervik SplunkTrust in Deployment Architecture 03-27-2017 0 4	0	4