Deployment Architecture

Discussions

Thread Info

Using the bucket command, why doesn't one bucket range appear?

I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1...

by Explorer in

splunkd and splunkweb are up for a cluster peer, but why is it repetitively downloading the cluster bundle with the following errors?

We have clustered environment Version : v6.1.1 1 x CM (Multi-Site, rf=2, site_rf=origin:1,site1:1,site2:1,total:2...

by Communicator in

Possible to add linux search peer with Putty key and without username or password?

Hello, I am trying to add another search peer to my search head, through the Settings > Distributed Search menu. I do...

by Path Finder in

Migrating to a distributed search architecture, is it required to change the distributed management console from standalone to distributed?

We are migrating from 2 x split indexers (standalone) instances to 2 x split indexers and a dedicated search head / D...

by Engager in

Deployment Server vs. Deployer

I am having a hard time trying to understand the difference between the two. I wonder if Splunk can make future name ...

by Path Finder in

Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server?

Good morning. We are (finally) looking to upgrade and add a second indexer in the mix. Our current setup is the fo...

by Contributor in

More than 100 “EventID=8306 sourcetype="xyz"” in 15 minutes on an individual host base

i want an alert setup in splunk for 100 occurrence of event id 8306 per host for sourcetype "xyz" in 15 minutes.. ...

by Explorer in

Has anyone scaled Splunk across a multisite deployment? How has it worked out for you and are there capacity planning tips?

Hello, I am trying to start a new Splunk project. I have 3 sites across the U.S. I would like to implement Splunk....

by Path Finder in

Why are my 3 search heads in a search head clustering environment filling up the directory "/opt/splunk/var/lib/splunk/kvstore/mongo"?

I'm currently building out a Splunk environment and could do with some help. The three search heads (clustered) a...

by Explorer in

How to Get Edits to "Take"?

I've used the information previously posted to manually update some XML files in an application and then to restart s...

by Explorer in

Host-specific files with Deployment Server

Hi. After getting tired of managing 20 individual lightforwarders and one indexer, I've decided to make use of the De...

by Builder in

Can we enable shared KV store with Search Head Pooling (not clustering)?

We're not ready to apply Search Head Clustering yet, but we're on Search Head Pooling now. Can we apply KV store quic...

by Communicator in

Why does the bucket command show 3 rows when bin=4, but 1 row when bin=3?

when I use the following: index= _internal | bucket size bins=3 |stats count(_raw) by size I see: size------...

by Contributor in

Is there a curl command to execute a rolling restart in a search head cluster?

From the docs http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/RestartSHC One has to identify the sear...

by Builder in

How to update the search head configuration from the cluster master?

I'm trying to update the configuration of all the peers from my cluster master. With the indexers, it's eash to put t...

by Explorer in

Why are we getting "Replication factor not met" in our multisite indexer clustering environment?

We have configured multisite indexer clustering (2 peers at each site1/2 and one search head at site 1) with the belo...

by Path Finder in

Splunk DB connect: How to change maximum size per event

Environments: Windows Server 2008 R2, Splunk 6.2.3, DB connect 1.2, JRE8, MSSQL There are some events of more than...

by Engager in

If I have a replication factor of 3, when data rolls to frozen, will it store 3 copies of the same frozen bucket?

I have been searching for hours and have, so far, come up empty. If I have a RF=3 and SF=3, when data rolls to my fro...

by Path Finder in

Server.conf serverName variables

I am trying to develop a standardized version of server.conf to deploy to all my forwarders. In a Windows environm...

by Communicator in

Splunk Architecture for two servers

Hello All, I have two high-performance servers for Splunk in different segments. The first server will receive dat...

by Path Finder in

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Hello, I have been working on Splunk for some time and have seen its use for server/application monitoring. I have...

by Explorer in

Search head clustering with multisite indexing cluster - What happens when main site goes down?

Hi, I'm designing a new Splunk solution based on Search head clustering on top of a multi site indexing cluster. (...

by Explorer in

LEA Client doesn't connect to Check Point OPSEC LEA Server

I am getting the errors below when i try to made a new connection to a checkpoint log server my opsec.log 2015-06...

by Explorer in

Syncing dashboards and alerts on multi search head architecture

We're in the process of doing a major upgrade to our Splunk environment. We're effectively moving from a single insta...

by Explorer in

Forwarder not appearing in unix app

Hi, I have a universal forwarder that sends information to my indexer. Both have the *nix app installed. From the ...

by Explorer in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Using the bucket command, why doesn't one bucket range appear?

splunkd and splunkweb are up for a cluster peer, but why is it repetitively downloading the cluster bundle with the following errors?

Possible to add linux search peer with Putty key and without username or password?

Migrating to a distributed search architecture, is it required to change the distributed management console from standalone to distributed?

Deployment Server vs. Deployer

Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server?

More than 100 “EventID=8306 sourcetype="xyz"” in 15 minutes on an individual host base

Has anyone scaled Splunk across a multisite deployment? How has it worked out for you and are there capacity planning tips?

Why are my 3 search heads in a search head clustering environment filling up the directory "/opt/splunk/var/lib/splunk/kvstore/mongo"?

How to Get Edits to "Take"?

Host-specific files with Deployment Server

Can we enable shared KV store with Search Head Pooling (not clustering)?

Why does the bucket command show 3 rows when bin=4, but 1 row when bin=3?

Is there a curl command to execute a rolling restart in a search head cluster?

How to update the search head configuration from the cluster master?

Why are we getting "Replication factor not met" in our multisite indexer clustering environment?

Splunk DB connect: How to change maximum size per event

If I have a replication factor of 3, when data rolls to frozen, will it store 3 copies of the same frozen bucket?

Server.conf serverName variables

Splunk Architecture for two servers

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Search head clustering with multisite indexing cluster - What happens when main site goes down?

LEA Client doesn't connect to Check Point OPSEC LEA Server

Syncing dashboards and alerts on multi search head architecture

Forwarder not appearing in unix app

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

Search results differ between real-time search and...

Setup Splunk on AWS Elastic Beanstalk

Splunk Intermediate Forwarder Setup

CMMC Version 2.0

Stream forwarder only works when running as root