Deployment Architecture

Discussions

Thread Info

How to save a certain index to different location on an indexer (not the whole SPLUNK_DB)?

I have few noisy indexes that I would like to save to another drive on the Splunk Indexer server. What would be the b...

by New Member in

Servers are sending data in GMT time zone but splunk instances are on EST time zone

Hi, The servers from which we are getting data is in GMT timezone. But splunk instances are on EST timezone. We are g...

by Path Finder in

Should we use a single search head with a high number of cores or a search head cluster?

Hello, We're looking at expanding our Splunk capabilities, and I'd like some additional input on the question of d...

by Contributor in

Not able to restart splunk instance

Hi I am not able to restart splunk process I am getting Can't unlink pid file "/opt/splunk/var/run/splunk/splu...

by Contributor in

Is there a centralized way to deploy configuration files?

Hello All, I have not found this answer yet. I am in the process of configuring and testing a deployment server. My e...

by Path Finder in

DMC: Search heads shown as heavy forwarders?

I'm in a setup with a license/deployment server, three clustered search heads and a deployer, and three non-clustered...

by Path Finder in

What is the mgmtHostPort configured on the forwarder

Hi I have a situation where i had to change the mgmtHostPort on my forwarder from 8089 to 9089 as it would not sta...

by Motivator in

my files not all indexed ?

Hello, I'm using Splunk Light, being in trial period (max indexation = 5Go/day) I have 19 files: r_licencie_...

by Builder in

We have two indexers in our cluster with SF=2 and RF=2. From the past week I am observing that there is huge difference(almost 8K) in buckets between the indexers. is this normal or we need to take any action?

And also I observed that we are getting following error frequently. Problem replicating config (bundle) to search ...

by Explorer in

Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

Running on Splunk 6.4.2 Can someone tell me proper procedures to update the RHEL7 OS, as to limit Splunk downtime? ...

by New Member in

Deployment server errors - 6.2

After a recent upgrade to 6.2 I have been getting this error when attempting to apply some changes via the deployment...

by Path Finder in

Can a forwarder be client of two deployment servers?

I would like to configure one of my forwarders to be part of two deployment pools. In the deploymentclient.conf's doc...

by Explorer in

Why am I unable to send audit logs from Linux to Splunk via rsyslog?

hi all, I need to send audit logs from RedHat 5.8 to my Splunk Indexer - both machines on the same network. On ...

by Explorer in

How to create a macro for the below scenario?

I have a search as follows earliest="08/01/2016:00:00:01" latest="08/01/2016:23:59:59" getABCsWin("XYZ","abc123456...

by Builder in

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?

I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows...

by Explorer in

Use a different Index based on a server class

Hi I would like to use a different Index for each of my environments (Production, Preproduction, Test, etc) and us...

by Explorer in

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

What are the reasons which can cause this error in non clustered indexes ? As both the major and minor versions ar...

by Builder in

Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs)

Hello All, I am getting this error on master node and search head as well. can anybody help me here Search pee...

by Contributor in

Deployment of Splunk TA for windows via deployment server

Hi , We deployed Splunk universal forwarder through sccm which had the sendtoindexer app pointing to indexer and d...

by Explorer in

After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads?

I need to remove some automatic lookups from the search heads (SH), but they are ones which were migrated from search...

by SplunkTrust in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

How to save a certain index to different location on an indexer (not the whole SPLUNK_DB)?

Servers are sending data in GMT time zone but splunk instances are on EST time zone

Should we use a single search head with a high number of cores or a search head cluster?

Not able to restart splunk instance

Is there a centralized way to deploy configuration files?

DMC: Search heads shown as heavy forwarders?

What is the mgmtHostPort configured on the forwarder

my files not all indexed ?

We have two indexers in our cluster with SF=2 and RF=2. From the past week I am observing that there is huge difference(almost 8K) in buckets between the indexers. is this normal or we need to take any action?

Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

Deployment server errors - 6.2

Can a forwarder be client of two deployment servers?

Why am I unable to send audit logs from Linux to Splunk via rsyslog?

How to create a macro for the below scenario?

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?

Use a different Index based on a server class

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

Search peer USADC-xxxxx has the following message: Too many streaming errors to target=xx.2.70.xxx:8080. Not rolling hot buckets on further errors to this target. (This condition might exist with other targets too. Please check the logs)

Deployment of Splunk TA for windows via deployment server

After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads?

SplunkTrust | Where Are They Now - Michael Uschmann

Admin Your Splunk Cloud, Your Way

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

SSH Weak Key Exchange Algorithms Enabled

"All Configurations" timeout issue while accessing...

Configuration Bundle Actions Last Validate and Che...

How to return old version of distsearch.conf file?

How can I enable DDL and DML logs to be sent from ...