Deployment Architecture

Deployment Architecture
Community Activity
criscollins
We are required to monitor /var/log/audit. Whenever splunkd accesses audit.log a new event is created. We are getting...
by criscollins New Member in Deployment Architecture 10-20-2016
0 3
0
3
msudhindra
Hello ! With the latest v 6.3 that was released earlier today, one of the features that was introduced was the abili...
by msudhindra Path Finder in Deployment Architecture 10-20-2016
1 8
1
8
pwongcha
My goal is to find out statistics for particular error in all servers. Scenario what host have error 'E' the most? d...
by pwongcha Explorer in Deployment Architecture 10-20-2016
0 8
0
8
untieshoe
Can I piggy-back (insert) a Win32 setup.exe (windows program) onto a Splunk App, and use Splunk Deployment Server to ...
by untieshoe Path Finder in Deployment Architecture 10-19-2016
0 4
0
4
jasonluk
I have an indexer host siem2 to collect forwarded logs from Trendmicro Control Manager and it stores it in path /opt/...
by jasonluk New Member in Deployment Architecture 10-19-2016
0 1
0
1
mchopra
Hi I have installed Splunk Universal Forwarder to send messages to an indexer (version 5.0.1). The messages are bein...
by mchopra New Member in Deployment Architecture 10-18-2016
0 2
0
2
mufgadmin
0
3
jincy_18
Hi All, We are using a clustered environment with 3 indexers, 3 search-heads, a deployer and a heavy weight forwarde...
by jincy_18 Path Finder in Deployment Architecture 10-17-2016
0 6
0
6
cdstealer
Hi, I think this has been asked a couple times over the past few years, but no real answer. Obviously the forwarder...
by cdstealer Contributor in Deployment Architecture 10-17-2016
0 5
0
5
zipmaster07
I'm having a very hard time connecting my search head cluster to my search peer. I have stepped through the search he...
by zipmaster07 Engager in Deployment Architecture 10-17-2016
0 11
0
11
edwinmae
Hi, Does anybody know what could be the cause why the tcpin_connections (group) is missing entirely from _internal i...
by edwinmae Path Finder in Deployment Architecture 10-17-2016
1 5
1
5
splunk_force_as
OR does it first pass through the other three processing queues() after the input queue and get ignored by processing...
by splunk_force_as Path Finder in Deployment Architecture 10-16-2016
0 2
0
2
vikram_m
Hello Team, I am been asked regularly in interviews what are the minimum requirements for a successful Splunk instan...
by vikram_m Path Finder in Deployment Architecture 10-15-2016
0 1
0
1
zthomas
I am attempting to convert my indexer cluster to use volumes for storage instead of directly setting homePath and col...
by zthomas Explorer in Deployment Architecture 10-14-2016
0 12
0
12
bryanwiggins
[env] centos 7, splunk enterprise 6.4.1 4x search heads (-mode searchhead -master_uri cluster_master) [2 heads are se...
by bryanwiggins Path Finder in Deployment Architecture 10-14-2016
0 5
0
5
Lucas_K
Is it possible to have a search head cluster in which some of the members have a different time zone? Documentation ...
by Lucas_K Motivator in Deployment Architecture 10-13-2016
0 9
0
9
rakesh_498115
Hi Team. I have a file name called /var/log/messages which I need to send to two different indexes (say index="A" an...
by rakesh_498115 Motivator in Deployment Architecture 10-13-2016
0 2
0
2
frankyip
I have two indexers A and B. UF always send data to A. If A is down, then UF send data to B. Is it possible to enforc...
by frankyip Engager in Deployment Architecture 10-13-2016
0 2
0
2
skender27
Hi, I am looking for a documentation which describes the necessary steps in case of a disaster recovery (the host wh...
by skender27 Contributor in Deployment Architecture 10-13-2016
0 5
0
5
tikoonikhil
I am running this query in splunk which aggregates and bucketizes the data on a weekly basis , based on the field "im...
by tikoonikhil Explorer in Deployment Architecture 10-13-2016
0 2
0
2
gcusello
Hi at all, I have an all-in-one Splunk 6.4.3 installed on Windows 2012/R2 to manage both Linux and Windows Forwarders...
by SplunkTrust SplunkTrust in Deployment Architecture 10-13-2016
0 2
0
2
pavankumarh
hi, when we set frozenTimePeriodInSecs=30 days for an index. i have read through the documentation and forums that th...
by pavankumarh Path Finder in Deployment Architecture 10-12-2016
0 4
0
4
nishwanth
I have 4 servers in which 2 are clustered and are used as search heads, a 3rd one is Splunk Enterprise Security, and ...
by nishwanth Engager in Deployment Architecture 10-12-2016
0 6
0
6
kgregor
Hey there, quick question: the raw data in the buckets are stored in a compressed way. The index files point to thes...
by kgregor New Member in Deployment Architecture 10-12-2016
0 1
0
1
sarnagar
Hi Team, Im new to the splunk team in my organisation and they have servers A , B , C, D etc. There are splunk insta...
by sarnagar Contributor in Deployment Architecture 10-12-2016
1 3
1
3
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...