Deployment Architecture

Discussions

Thread Info

Why are Django apps suddenly not working on the search head with error "root:645 - The SECRET_KEY setting must not be empty."?

Hi Splunkers, Suddenly Django apps are not working in the Search head and we get the below error: root:644 - DJ...

by Explorer in

UDP Drops on Linux

At a site, we are doing 5000-20000 EPS (Events Per Second) all udp/514 at each of 10 locations. At this time, we are ...

by Contributor in

SSL flows within deployed app

Hi there. We have our data ingestion ssl flows distributed to our heavy forwarders within an app. So the certs and...

by Communicator in

What is the best way to recreate and deploy an app with a custom navigation bar from a 5.0.7 search head in a 6.3.3 search head cluster?

We currently have a standalone search head (5.0.7) with customization to the nav bar ( etc/apps/search/local/data/ui/...

by Path Finder in

Why am I unable to connect to a Splunk API URL from an external VM by replacing localhost with the search head IP?

Hi I am trying to connect to Splunk API from a different VM. My API command works when I run this as localhost...

by Explorer in

How many servers do I need to implement a Splunk 6.4.x indexer cluster?

Hello, Environment overview: 2 Data Centers 1 Datecollector 1 Splunk enterprise 6X Server working as a search head...

by Explorer in

How to check if all apps listed in server class exists in deployment apps directory?

I want to perform a check on the deployment server before reloading any apps: integrate through all stanzas and id...

by Builder in

Deploying onto Search Head pool sometimes causes errors

Hi guys We are testing the Search Head pooling functionality. We have one dedicated deployer and 5 searchhead clus...

by Communicator in

Why does the number of temporary buckets exceed the number of replicated buckets in an indexer cluster?

Hi All, I am following this document to get an understanding about the indexer cluster bucket replication in Splun...

by Path Finder in

Can I get a list of all accounts across SHC?

Hi, Is there a way to get a list of all accounts across a SHC?

by Champion in

Why are admin settings not accessible after upgrading the search head cluster environment to 6.4.1?

Hidden admin settings are not accessible after upgrading the search head cluster environment to 6.4.1. As a admin use...

by Path Finder in

How to programmatically add an application to a server class in deployment server?

I have to create and configure a few dozen serverclasses. Trying to script it. I can create the serverclasses just...

by Contributor in

Will Search Head Pooling work in Splunk 6.4.1?

Hi, We are upgrading to Splunk 6.4.1, but in multiple stages, the second stage being migrating to Search Head Clus...

by Champion in

How to move internal indexes from the default location to a new directory in an indexer clustering environment?

I have a distributed search environment consisting of 2 x indexers, 1 x master node, and a search head. Currently,...

by Builder in

Do I need to point a new search head to the master node or search peers of an indexer cluster?

Hello, I have an indexer cluster setup. I don't want to configure a search head node in a cluster. I want to start...

by Path Finder in

Does Splunk recognize when buckets are deleted?

I am doing a simple recovery test and deleted some warm buckets, but Splunk doesn't seem to even realize anything is ...

by Motivator in

Where can I find detailed documentation on best practices deploying search head and indexer clusters?

There is quite a lot of documentation about doing a Splunk deployment and I just want to see if anyone has a consolid...

by Contributor in

Is there a solution to back up Splunk data into HDFS to make it available for search via Hunk?

As a backup solution for Splunk’s data, we wonder what might be a solution to back up the Splunk data into HDFS and m...

by Ultra Champion in

Should I be worried about these bundle replication messages??

Splunk Version 6.3.4 Search head cluster of 3 nodes Indexer distributed search peers 4 nodes I see the following e...

by Builder in

Indexer cluster autoscaling, how to configure universal forwarders with the new indexer endpoints.

We are using a splunk indexer cluster in AWS using autoscaling to increase the cluster size. Universal forwarders are...

by Explorer in

If a peer goes down in an indexer cluster, how does new indexed data get replicated, and what happens when the peer comes back up later?

Little confused in Indexer Clustering. I have 3 peers with One master and One Search Head. Replication Factor is 3 an...

by Communicator in

Can bucket rotation be turned off?

I would like to keep "All" data in a single bucket. There is a potential performance impact when Splunk rotates data ...

by New Member in

Can I upgrade a search head cluster by a rolling upgrade?

Hello Community, I want to upgrade an indexer cluster and a search head cluster from 6.3.3 to 6.3.4. From Splunk d...

by Explorer in

Is it possible to access the Splunk CLI locally without credentials, or limit credentials just to the local host?

I have a script which runs on the deployment server and maintains the contents of ../deployment-apps/... out of a git...

by Contributor in

Are there any issues with setting up the Distributed Management Console in distributed mode on a test or demo search head?

We have a testing or demo environment configured as distributed search that contains one search head, multiple indexe...

by New Member in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Why are Django apps suddenly not working on the search head with error "root:645 - The SECRET_KEY setting must not be empty."?

UDP Drops on Linux

SSL flows within deployed app

What is the best way to recreate and deploy an app with a custom navigation bar from a 5.0.7 search head in a 6.3.3 search head cluster?

Why am I unable to connect to a Splunk API URL from an external VM by replacing localhost with the search head IP?

How many servers do I need to implement a Splunk 6.4.x indexer cluster?

How to check if all apps listed in server class exists in deployment apps directory?

Deploying onto Search Head pool sometimes causes errors

Why does the number of temporary buckets exceed the number of replicated buckets in an indexer cluster?

Can I get a list of all accounts across SHC?

Why are admin settings not accessible after upgrading the search head cluster environment to 6.4.1?

How to programmatically add an application to a server class in deployment server?

Will Search Head Pooling work in Splunk 6.4.1?

How to move internal indexes from the default location to a new directory in an indexer clustering environment?

Do I need to point a new search head to the master node or search peers of an indexer cluster?

Does Splunk recognize when buckets are deleted?

Where can I find detailed documentation on best practices deploying search head and indexer clusters?

Is there a solution to back up Splunk data into HDFS to make it available for search via Hunk?

Should I be worried about these bundle replication messages??

Indexer cluster autoscaling, how to configure universal forwarders with the new indexer endpoints.

If a peer goes down in an indexer cluster, how does new indexed data get replicated, and what happens when the peer comes back up later?

Can bucket rotation be turned off?

Can I upgrade a search head cluster by a rolling upgrade?

Is it possible to access the Splunk CLI locally without credentials, or limit credentials just to the local host?

Are there any issues with setting up the Distributed Management Console in distributed mode on a test or demo search head?

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Index This | I am a number but I am countless. What am I?

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

Why are there multiple results from the reporting ...

How should EKS be configured for experimenting wit...

Setup Splunk on AWS Elastic Beanstalk

CMMC Version 2.0

Stream forwarder only works when running as root