Deployment Architecture

Community Activity

Migrating hot/warm and cold buckets to separate drives This is more an FYI as to how we did it than an actual question. Took us a while to find all the info we needed to be... by ejharts2015 Communicator in Deployment Architecture 12-05-2016 6 6	6	6
When old indexer servers in an indexer cluster are moved to new servers, what is the best way to move disk or data? Situation: Indexer cluster, dual site, replication factor=2 We have some old indexer servers to be moved to new serv... by koshyk Super Champion in Deployment Architecture 12-03-2016 0 5	0	5
Splunk 6.5 is ignoring https_proxy in splunk-launch.conf So Splunk is ignoring the https_proxy settings in my splunk-launch.conf file. The details of how i am positive are s... by awmorris Path Finder in Deployment Architecture 12-02-2016 0 10	0	10
What is the difference between using repFactor=0 versus repFactor=1? Can anyone explain to me the differences between using repFactor=0 and repFactor=1? We only replicate specific crit... by goodsellt Contributor in Deployment Architecture 12-02-2016 0 2	0	2
Why do so few apps support search head clustering? When all the apps that the business finds and wants to use, do not work with search head clustering? I'm not talking ... by dbizzle Explorer in Deployment Architecture 12-01-2016 0 9	0	9
Is Splunk supported on Red Hat Enterprise Linux 7 running Linux kernel 3.10? Would Splunk work with RHEL 7? From what I have read, RHEL 7 runs Linux kernel 3.10 and the documentation in Splunk... by keithyap Path Finder in Deployment Architecture 12-01-2016 0 9	0	9
How to know Network info and Splunk existing info from the existing Splunk configuration Hi Guys, How to know total indexer placed, total source types, total IP networks from the Splunk GUI? How to know... by Steave4app New Member in Deployment Architecture 12-01-2016 0 2	0	2
What happens when changing deployment servers? In order to test configurations before going to production we want to set forwarders to go to our development environ... by mdsnmss SplunkTrust in Deployment Architecture 11-30-2016 0 1	0	1
Why are events in my indexer cluster not the same even though the index has repFactor = auto? Hey guys, i have 1 search head, 2 peers, and 1 master. On replication Factor 2. my index has repFactor=auto, but i... by felipesewaybric Contributor in Deployment Architecture 11-30-2016 0 1	0	1
Which Add Data button should I use to import data into a clustered index? In our Splunk Enterprise Environment, we have 3 search heads, 7 indexers, and a cluster master. If we wanted to use ... by mpulis8966 Explorer in Deployment Architecture 11-30-2016 0 2	0	2
I have made an index on the indexer( in /splunk/etc/local/indexes.conf) but I am not able to see it in my search head while searching. Can you tell me why is this happening? Q1) I am setting up a test environment for splunk. I have made an index on indexer from backend but when I am searchi... by arpit_1210 Explorer in Deployment Architecture 11-30-2016 0 2	0	2
How to deploy the Splunk Add-on for Check Point OPSEC LEA in a multisite indexer cluster? Hi, Can anyone please offer advice on how to best deploy the Splunk Add-on for Check Point OPSEC LEA on a multisite... by rccargill New Member in Deployment Architecture 11-29-2016 0 8	0	8
How do you make sure Search Head Cluster objects are synced in all nodes? If someone were to modify the savedsearches.conf via the CLI in one of the nodes of a search head cluster, what would... by ben_leung Builder in Deployment Architecture 11-29-2016 0 8	0	8
What capability is needed to create a new index? What capability is needed to create a new index? There is a capability for editing an index, is that used for creatio... by marcusnilssonmr Path Finder in Deployment Architecture 11-29-2016 0 2	0	2
After changing data retention, why is indexes.conf not working on one indexer? Hi I have changed the data retention and pushed the bundle from the cluster master. In 2 indexers, the data got del... by kiran331 Builder in Deployment Architecture 11-29-2016 0 5	0	5
set hostname Hi at all, I have to create an Heartbeat Alert that contains three fields: TimeStamp,HostNameMessage My problem is H... by gcusello SplunkTrust in Deployment Architecture 11-25-2016 0 2	0	2
kvstore on Search Head Cluster - disk utilisation imbalance I have a Splunk 6.4 environment with 3-member SH Cluster running kvstore without replication to the indexer tier. Th... by marko_CD Explorer in Deployment Architecture 11-24-2016 0 3	0	3
Warning in log after index move Hello I've moved some indexes to a new path, everything works fine. In the splunkd.log I see a Warning now from one... by nicocin Path Finder in Deployment Architecture 11-23-2016 0 2	0	2
Deployment Server and Load Balancer? Can you put a deployment server behind a load balancer if the deployment-apps directory is on an NFS share and server... by gschmitz Path Finder in Deployment Architecture 11-22-2016 1 4	1	4
How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index? Let's take an Example. I have 3 indexes: Index1, Index2, Index3 For each index the data moves from hot to warm, war... by dpraveen88 Explorer in Deployment Architecture 11-22-2016 0 2	0	2
How to migrate savedsearches.conf from one search head cluster to another? I need to migrate two savedsearches.conf files to a new search head cluster: /opt/splunk/etc/apps/search/local/saved... by brent_weaver Builder in Deployment Architecture 11-21-2016 0 2	0	2
CHAR INDEX query same as MS SQL index="prod_client_sync_dbconnect" sessionid!=sessionid \| eval exception=substr(exception,1,150) \| stats count as "... by puneethgowda Communicator in Deployment Architecture 11-21-2016 0 3	0	3
Using REST API load balancing in a Search Head Cluster, why are session keys not replicated? Hello We have implemented a search head cluster behind an F5 LTM. I've created an LTM VIP with cookie persistence fo... by ashleyherbert Communicator in Deployment Architecture 11-18-2016 1 4	1	4
Hosts added to Splunk instance Hi, How to get list of hosts added to our splunk instance in the past week? Thanks in Advance by kiran_mh Explorer in Deployment Architecture 11-18-2016 0 3	0	3
Are multisite primary buckets concurrently searchable by a search head cluster with site affinity disabled? I've been wondering if a multisite indexer cluster with searchable primary buckets in each site will serve data from ... by dolivasoh Contributor in Deployment Architecture 11-16-2016 1 6	1	6

Get Updates on the Splunk Community!

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Splunk Cloud Application Management in Terraform

Now On-Demand We’re diving into how you can bring Infrastructure as Code (IaC) principles to your Splunk ...

Deployment Architecture

Migrating hot/warm and cold buckets to separate drives

When old indexer servers in an indexer cluster are moved to new servers, what is the best way to move disk or data?

Splunk 6.5 is ignoring https_proxy in splunk-launch.conf

What is the difference between using repFactor=0 versus repFactor=1?

Why do so few apps support search head clustering?

Is Splunk supported on Red Hat Enterprise Linux 7 running Linux kernel 3.10?

How to know Network info and Splunk existing info from the existing Splunk configuration

What happens when changing deployment servers?

Why are events in my indexer cluster not the same even though the index has repFactor = auto?

Which Add Data button should I use to import data into a clustered index?

I have made an index on the indexer( in /splunk/etc/local/indexes.conf) but I am not able to see it in my search head while searching. Can you tell me why is this happening?

How to deploy the Splunk Add-on for Check Point OPSEC LEA in a multisite indexer cluster?

How do you make sure Search Head Cluster objects are synced in all nodes?

What capability is needed to create a new index?

After changing data retention, why is indexes.conf not working on one indexer?

set hostname

kvstore on Search Head Cluster - disk utilisation imbalance

Warning in log after index move

Deployment Server and Load Balancer?

How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

How to migrate savedsearches.conf from one search head cluster to another?

CHAR INDEX query same as MS SQL

Using REST API load balancing in a Search Head Cluster, why are session keys not replicated?

Hosts added to Splunk instance

Are multisite primary buckets concurrently searchable by a search head cluster with site affinity disabled?

Introducing the 2026 - 2027 SplunkTrust cohort!

Splunk Auto Ingestion Parallel Pipeline Scaling

Splunk Cloud Application Management in Terraform

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation