Deployment Architecture

Discussions

Thread Info

None Domain Environment

I have Splunk at work and am new to it so I want to learn as much as I can. I installed it at home on my Windows 7 PC...

by New Member in

How to delete searches in a Search Head Cluster environment?

I run a distributed environment within which the Search tier is comprised of a Search Head Cluster. All my Splunk app...

by Engager in

Deployment Server unable to phone home

I recently upgraded from 4.3 to 6.3.3 using an RPM update. I followed the recommendations of Splunk and upgraded from...

by New Member in

Heavy Forwarders

Quick question about HF. Do you necessarily need two separated Splunk instances for Heavy Forwarding data? (One fo...

by Communicator in

Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

Hi We have weird behavior, in the Data Summary Screen on the Search Head, we see a Host reporting events, when cli...

by Path Finder in

How to manually delete buckets in cluster peers?

I know that in a clustered environment, I cannot just manually delete/roll the buckets off colddb directory manually....

by Splunk Employee in

Search Head not Getting latest events from Indexer

Good morning, We have an splunk architecture with 2 Search Heads and 2 Indexers. This morning when our user tried ...

by Explorer in

Why does Forwarder Management on the Splunk 6.3.3 deployment server show "0 deployed" clients?

We have updated our test Splunk infrastructure to 6.3.3 to evaluate this version before updating the production lands...

by Path Finder in

How can I find duplicate scheduled searches running in a search head clustering environment?

I have a three Node Search Head Cluster environment and I suspect that some of the scheduled searches are running mul...

by Communicator in

If we have database connectors set up in Splunk, can we create data models using database queries?

Hello, We have database connectors set up in Splunk to run database queries. Can you create Data Models using data...

by Explorer in

Why am I unable to generate a diag from an indexer cluster peer after upgrading to Splunk 6.4.0?

After upgrading to 6.4.0 today, we are unable to generate a diag from an indexer cluster peer: When I attempt to ...

by Splunk Employee in

Which tool to use to backup indexed data efficiently ?

Hello, I would like to backup the indexed data on a remote server. I tried rsync: rsync -aAXv -R -e ssh --exclu...

by Contributor in

Splunk archiving: how to reduce the number of buckets

I am using the Splunk archiving feature where events are archived to HDFS after a certain amount of time (23 days in ...

by SplunkTrust in

TZ (timezone) -- where do I set it in a clustered environment?

Hello, we have a syslog device that is sending log in UTC, but we need them to be in US/Pacific. Where do I set the T...

by Communicator in

How to reload deployment server passing credentials silently

I'm trying to get Splunk to reload the deployment server when we have updated our apps without having to manually go ...

by Explorer in

Calculate the difference between two values by time division

Hi all, I need to get some stats from an Apache ActiveMQ message broker. The broker has a web dashboard of broker ...

by Path Finder in

No _internal results from distributed search head

As a pretty new user, I recently installed the Universal Forwarder on a Linux server, created a file input, and forwa...

by Builder in

Where level of effort is measured in number of days, what is the difference (if any) in the level of effort to deploy a Term, on-premise Splunk deployment versus a Splunk Cloud deployment?

Where level of effort is measured in number of days, what is the difference (if any) in the level of effort to deploy...

by New Member in

Is it possible to install a master node and a search head on the same VM?

Hi Splunkers, I am new to Splunk and I have to install and configure Splunk on three virtual machines (1 Search H...

by Explorer in

Multisite Distributed Search: Why am I getting search head error "Encountered an error deserializing SearchResultsInfo from Results Stream header"?

Hi, In a multisite distributed search environment with 1 search head and 4 indexers, it seems that the Search Head...

by Explorer in

Why do I have this search head cluster synchronization problem?

Hi all, Upon provisioning a new environment (where we don’t have SSH access), we’ve noticed 2 errors in the messa...

by Path Finder in

Is there a way to reload server class from the Splunk GUI?

Hi! I'm using Splunk 6.1.4 deployment server with quite many forwarders connecting to it for apps/TAs. Whenever I ...

by Path Finder in

How does Splunk forwarder handle data after uninstalling and reinstalling an app?

I have a bunch of forwarder machines that were inadvertently renamed recently. As a result, our forwarder manager no ...

by Contributor in

Provisioning via the deployment server and REST API to add a node to a serverclass with existing and new ordinals (whitelist)

Hi, We are attempting to use deploy Splunk in our private cloud using chef, and provisioning via the deployment se...

by Champion in

Search Head Cluster: Pre 6.3 we could run more number of Schduled Searches Concurrently.

Prior to 6.3, quotas were enforced instead on a member-by-member basis for SHC we have the System Wide Quote Working....

by Communicator in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

None Domain Environment

How to delete searches in a Search Head Cluster environment?

Deployment Server unable to phone home

Heavy Forwarders

Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

How to manually delete buckets in cluster peers?

Search Head not Getting latest events from Indexer

Why does Forwarder Management on the Splunk 6.3.3 deployment server show "0 deployed" clients?

How can I find duplicate scheduled searches running in a search head clustering environment?

If we have database connectors set up in Splunk, can we create data models using database queries?

Why am I unable to generate a diag from an indexer cluster peer after upgrading to Splunk 6.4.0?

Which tool to use to backup indexed data efficiently ?

Splunk archiving: how to reduce the number of buckets

TZ (timezone) -- where do I set it in a clustered environment?

How to reload deployment server passing credentials silently

Calculate the difference between two values by time division

No _internal results from distributed search head

Where level of effort is measured in number of days, what is the difference (if any) in the level of effort to deploy a Term, on-premise Splunk deployment versus a Splunk Cloud deployment?

Is it possible to install a master node and a search head on the same VM?

Multisite Distributed Search: Why am I getting search head error "Encountered an error deserializing SearchResultsInfo from Results Stream header"?

Why do I have this search head cluster synchronization problem?

Is there a way to reload server class from the Splunk GUI?

How does Splunk forwarder handle data after uninstalling and reinstalling an app?

Provisioning via the deployment server and REST API to add a node to a serverclass with existing and new ordinals (whitelist)

Search Head Cluster: Pre 6.3 we could run more number of Schduled Searches Concurrently.

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

After Migrate single site to multisite Indexer clu...

Stream forwarder only works when running as root

Search Cluster Overwriting etc/system/local/inputs...

What it takes to replace SAS with Splunk on IBM Z ...

app/launcher/home requires xml -- won't launch jso...