Deployment Architecture

Community Activity

Why am I unable to send audit logs from Linux to Splunk via rsyslog? hi all, I need to send audit logs from RedHat 5.8 to my Splunk Indexer - both machines on the same network. On RHEL... by rb51 Explorer in Deployment Architecture 09-15-2016 0 2	0	2
How to create a macro for the below scenario? I have a search as follows earliest="08/01/2016:00:00:01" latest="08/01/2016:23:59:59" getABCsWin("XYZ","abc12345678... by pavanae Builder in Deployment Architecture 09-15-2016 0 3	0	3
Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers? I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows... by Jrubalcaba Explorer in Deployment Architecture 09-14-2016 1 2	1	2
Use a different Index based on a server class Hi I would like to use a different Index for each of my environments (Production, Preproduction, Test, etc) and use ... by mjeanrichard Explorer in Deployment Architecture 09-14-2016 0 7	0	7
Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3} What are the reasons which can cause this error in non clustered indexes ? As both the major and minor versions are ... by splunk_zen Builder in Deployment Architecture 09-14-2016 0 3	0	3
Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs) Hello All, I am getting this error on master node and search head as well. can anybody help me here Search peer US... by gajananh999 Contributor in Deployment Architecture 09-14-2016 0 2	0	2
Deployment of Splunk TA for windows via deployment server Hi , We deployed Splunk universal forwarder through sccm which had the sendtoindexer app pointing to indexer and dep... by himapate Explorer in Deployment Architecture 09-14-2016 0 1	0	1
After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads? I need to remove some automatic lookups from the search heads (SH), but they are ones which were migrated from search... by cpetterborg SplunkTrust in Deployment Architecture 09-13-2016 0 4	0	4
Why are we seeing search peer error "A script exited abnormally" on our deployment server and how do we stop it? Getting multiples of the error below on our Deployment Server. Only references the server where Enterprise Security ... by jsbollard New Member in Deployment Architecture 09-13-2016 0 4	0	4
Splunk Forwarder No Longer passing file to enterprise system Hi All, I'm muddling through Splunk as I go. I'm part of a team working with it but we're all having to feel our way... by 999chris New Member in Deployment Architecture 09-10-2016 0 1	0	1
Splunk index congestion is happening Hi, I suddenly got this message "skipped indexing of internal audit event will keep dropping events until indexer con... by sravani387 New Member in Deployment Architecture 09-10-2016 0 2	0	2
Deployment Client: phoneHomeInterval to 15 mins hi, we were normally controlling around 250 clients using one server, but suddenly clients increased to 500+ and we a... by koshyk Super Champion in Deployment Architecture 09-09-2016 0 2	0	2
IO wait time on standalone Splunk enterprise server is very high We have a standalone server running all the functions and have close to 24 cores on it. The IO wait times peak to 45-... by jkalra Explorer in Deployment Architecture 09-09-2016 0 2	0	2
What is the difference between Cluster master and License master in a distributed Environment? What is the difference between Cluster master and License master in a distributed Environment? Any major differences... by pavanae Builder in Deployment Architecture 09-08-2016 0 1	0	1
Orphaned Scheduled Search (cannot delete) Hi, I'm in a Search Head Cluster environment and while looking at our scheduling load, I found some references to sch... by RMartinezDTV Path Finder in Deployment Architecture 09-08-2016 1 2	1	2
In which version of Splunk Indexer discovery was introduced? I wanted to know in which version of Splunk release 'indexer discovery' feature was introduced. by varad_joshi Communicator in Deployment Architecture 09-08-2016 0 2	0	2
Are the App level permissions replicated on a Search Head Cluster? The link provided (https://answers.splunk.com/answers/230771/search-head-cluster-how-to-manage-new-roles-betwee-1.htm... by sat94541 Communicator in Deployment Architecture 09-07-2016 0 1	0	1
Search Head Cluster - Unable to add Search Head Cluster member - WARN: call not properly authenticated I'm trying to add a shcluster-member into a search head cluster with a CLI command: [shclustering] conf_deploy_fetch... by rbal_splunk Splunk Employee in Deployment Architecture 09-07-2016 1 1	1	1
Is it necessary to reload if we do any changes in serverclass.conf is it necessary to reload or restarting splunk will be sufficient? I am getting an error while reload Socket error communicating with splunkd (error=The read operation timed out), path... by dina1701 Engager in Deployment Architecture 09-07-2016 0 2	0	2
Splunkd service goes down every 24 hours on the forwarder On looking into the internal logs of the server on which forwarder is configured, I could observe that splunkd is sh... by yashwanth_g_pra Observer in Deployment Architecture 09-07-2016 0 1	0	1
Nested loop with compansion I would like to generate a monthly staff attendance report. I have two types of record, (1) monthly annual leave reco... by katalinali Path Finder in Deployment Architecture 09-07-2016 0 1	0	1
CMSlave - Error deserializing notify I have many entries like this: WARN CMSlave - event=handleNotifySummaries error deserializing notify file=/raid/spl... by lukasz92 Communicator in Deployment Architecture 09-06-2016 0 5	0	5
How to check whether splunk heavy forwarder is used only for forwarding not for indexeing the data ? Hi All, currently we are having two heavy forwarder instance which is mainly used to forward the syslog data to the i... by Hemnaath Motivator in Deployment Architecture 09-06-2016 0 2	0	2
Count filed value variation pet host per day Hello, I need to report antivirus daily update on servers, i have an hourly logging of each "Endpoint" with versi... by Ed_Alias Path Finder in Deployment Architecture 09-05-2016 0 2	0	2
Is there a way to invoke a REST command to validate whether a certain ldap group is available on a Search Head? As we embark new customers into Splunk, we are trying to automate the validations process. One challenges is to find ... by ddrillic Ultra Champion in Deployment Architecture 09-02-2016 0 2	0	2

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Deployment Architecture

Why am I unable to send audit logs from Linux to Splunk via rsyslog?

How to create a macro for the below scenario?

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?

Use a different Index based on a server class

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs)

Deployment of Splunk TA for windows via deployment server

After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads?

Why are we seeing search peer error "A script exited abnormally" on our deployment server and how do we stop it?

Splunk Forwarder No Longer passing file to enterprise system

Splunk index congestion is happening

Deployment Client: phoneHomeInterval to 15 mins

IO wait time on standalone Splunk enterprise server is very high

What is the difference between Cluster master and License master in a distributed Environment?

Orphaned Scheduled Search (cannot delete)

In which version of Splunk Indexer discovery was introduced?

Are the App level permissions replicated on a Search Head Cluster?

Search Head Cluster - Unable to add Search Head Cluster member - WARN: call not properly authenticated

Is it necessary to reload if we do any changes in serverclass.conf is it necessary to reload or restarting splunk will be sufficient?

Splunkd service goes down every 24 hours on the forwarder

Nested loop with compansion

CMSlave - Error deserializing notify

How to check whether splunk heavy forwarder is used only for forwarding not for indexeing the data ?

Count filed value variation pet host per day

Is there a way to invoke a REST command to validate whether a certain ldap group is available on a Search Head?

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation