Deployment Architecture

Community Activity

In an indexer cluster is there a way to query one indexer for data that it indexed as well as data that has been replicated to it? We have a distributed environment with multi-site indexer clustering and search head clustering. The replication fac... by myandow Path Finder in Deployment Architecture 09-21-2016 0 6	0	6
How can you compare performance between indexers in the same distributed indexer cluster? In our existing distributed indexer cluster we have systems with slightly different configurations(storage and some s... by myandow Path Finder in Deployment Architecture 09-21-2016 0 3	0	3
splunk remove data after indexing Hello I have a big problem with the addition of data. initially given 9 million are added. but after I find Splunk ... by TISKAR Builder in Deployment Architecture 09-21-2016 0 11	0	11
How to get list of hosts added to our instance in the last 7 days? Hi, I wanted to know hosts added to our instance in the last 7 days, We want to create a report for this, Kindly h... by kiran_mh Explorer in Deployment Architecture 09-21-2016 0 3	0	3
way to identify data not indexed hi all, recently, following an update to Splunk 6.4.3 we are having trouble finding data with searches that worked b... by mraudaschl Loves-to-Learn in Deployment Architecture 09-21-2016 0 1	0	1
Small Enterprise Cluster - General Questions I am currently setting up a Small Enterprise Cluster ... (1) SH (Not clustered) ( Also the License Server) (2) index... by rewritex Contributor in Deployment Architecture 09-20-2016 0 2	0	2
Can you mix Splunk Cloud and Splunk Enterprise? I want to know if it's possible to mix Splunk Cloud and Enterprise? We currently have multiple Splunk Clusters in dif... by peter_krammer Communicator in Deployment Architecture 09-20-2016 0 2	0	2
How to save a certain index to different location on an indexer (not the whole SPLUNK_DB)? I have few noisy indexes that I would like to save to another drive on the Splunk Indexer server. What would be the b... by pashtet13 New Member in Deployment Architecture 09-20-2016 0 2	0	2
Servers are sending data in GMT time zone but splunk instances are on EST time zone Hi, The servers from which we are getting data is in GMT timezone. But splunk instances are on EST timezone. We are g... by pasokkum Path Finder in Deployment Architecture 09-20-2016 0 3	0	3
Should we use a single search head with a high number of cores or a search head cluster? Hello, We're looking at expanding our Splunk capabilities, and I'd like some additional input on the question of doi... by goodsellt Contributor in Deployment Architecture 09-19-2016 0 2	0	2
Not able to restart splunk instance Hi I am not able to restart splunk process I am getting Can't unlink pid file "/opt/splunk/var/run/splunk/splunkwe... by adityapavan18 Contributor in Deployment Architecture 09-19-2016 0 12	0	12
Is there a centralized way to deploy configuration files? Hello All, I have not found this answer yet. I am in the process of configuring and testing a deployment server. My e... by avalle Path Finder in Deployment Architecture 09-19-2016 0 6	0	6
DMC: Search heads shown as heavy forwarders? I'm in a setup with a license/deployment server, three clustered search heads and a deployer, and three non-clustered... by cdoebert Path Finder in Deployment Architecture 09-19-2016 0 3	0	3
What is the mgmtHostPort configured on the forwarder Hi I have a situation where i had to change the mgmtHostPort on my forwarder from 8089 to 9089 as it would not start... by robertlynch2020 Influencer in Deployment Architecture 09-19-2016 0 2	0	2
my files not all indexed ? Hello, I'm using Splunk Light, being in trial period (max indexation = 5Go/day) I have 19 files: r_licencie_temp_1... by TISKAR Builder in Deployment Architecture 09-19-2016 0 2	0	2
We have two indexers in our cluster with SF=2 and RF=2. From the past week I am observing that there is huge difference(almost 8K) in buckets between the indexers. is this normal or we need to take any action? And also I observed that we are getting following error frequently. Problem replicating config (bundle) to search pe... by motkarnaresh Explorer in Deployment Architecture 09-19-2016 0 1	0	1
Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime? Running on Splunk 6.4.2 Can someone tell me proper procedures to update the RHEL7 OS, as to limit Splunk downtime? W... by adkinsdiet New Member in Deployment Architecture 09-16-2016 0 1	0	1
Deployment server errors - 6.2 After a recent upgrade to 6.2 I have been getting this error when attempting to apply some changes via the deployment... by LiquidTension Path Finder in Deployment Architecture 09-16-2016 0 3	0	3
Can a forwarder be client of two deployment servers? I would like to configure one of my forwarders to be part of two deployment pools. In the deploymentclient.conf's doc... by tcmarquesi Explorer in Deployment Architecture 09-16-2016 0 5	0	5
Why am I unable to send audit logs from Linux to Splunk via rsyslog? hi all, I need to send audit logs from RedHat 5.8 to my Splunk Indexer - both machines on the same network. On RHEL... by rb51 Explorer in Deployment Architecture 09-15-2016 0 2	0	2
How to create a macro for the below scenario? I have a search as follows earliest="08/01/2016:00:00:01" latest="08/01/2016:23:59:59" getABCsWin("XYZ","abc12345678... by pavanae Builder in Deployment Architecture 09-15-2016 0 3	0	3
Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers? I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows... by Jrubalcaba Explorer in Deployment Architecture 09-14-2016 1 2	1	2
Use a different Index based on a server class Hi I would like to use a different Index for each of my environments (Production, Preproduction, Test, etc) and use ... by mjeanrichard Explorer in Deployment Architecture 09-14-2016 0 7	0	7
Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3} What are the reasons which can cause this error in non clustered indexes ? As both the major and minor versions are ... by splunk_zen Builder in Deployment Architecture 09-14-2016 0 3	0	3
Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs) Hello All, I am getting this error on master node and search head as well. can anybody help me here Search peer US... by gajananh999 Contributor in Deployment Architecture 09-14-2016 0 2	0	2

Get Updates on the Splunk Community!

Guided Onboarding with Auto-schema Is Now Generally Available

We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Deployment Architecture

In an indexer cluster is there a way to query one indexer for data that it indexed as well as data that has been replicated to it?

How can you compare performance between indexers in the same distributed indexer cluster?

splunk remove data after indexing

How to get list of hosts added to our instance in the last 7 days?

way to identify data not indexed

Small Enterprise Cluster - General Questions

Can you mix Splunk Cloud and Splunk Enterprise?

How to save a certain index to different location on an indexer (not the whole SPLUNK_DB)?

Servers are sending data in GMT time zone but splunk instances are on EST time zone

Should we use a single search head with a high number of cores or a search head cluster?

Not able to restart splunk instance

Is there a centralized way to deploy configuration files?

DMC: Search heads shown as heavy forwarders?

What is the mgmtHostPort configured on the forwarder

my files not all indexed ?

We have two indexers in our cluster with SF=2 and RF=2. From the past week I am observing that there is huge difference(almost 8K) in buckets between the indexers. is this normal or we need to take any action?

Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

Deployment server errors - 6.2

Can a forwarder be client of two deployment servers?

Why am I unable to send audit logs from Linux to Splunk via rsyslog?

How to create a macro for the below scenario?

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?

Use a different Index based on a server class

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs)

Guided Onboarding with Auto-schema Is Now Generally Available

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation