Deployment Architecture

Community Activity

Can we downsize our indexer cluster? We are at 10 indexers ingesting around 400 GBs/day. A homogeneous environment with 1 millisecond wait time (I/O Write... by LovingSplunk Path Finder in Deployment Architecture 03-20-2026 0 12	0	12
How do I clear old indexers' bundles? On my indexers I have many bundles that are very old (some over 1 year old). What is the best way to configure Splunk... by LovingSplunk Path Finder in Deployment Architecture 03-13-2026 0 3	0	3
Change Universal Forwarder host/servername Hi,I work with a distributed Splunk Enterprise architecture and I am trying to update how some Universal Forwarder sh... by prusconi New Member in Deployment Architecture 03-11-2026 0 1	0	1
Cisco Enhanced Netflow Add-On Insanity Hello guys,I am currently banging my head on the wall trying to understand and deploy the "Cisco Catalyst Enhanced Ne... by lbertini New Member in Deployment Architecture 03-09-2026 0 0	0	0
How come the license master is configured as a search peer to the search head? I get this vulnerability log from the search head -/opt/splunk/var/run/searchpeers/<license-master-hostname>-17710294... by LovingSplunk Path Finder in Deployment Architecture 03-05-2026 0 4	0	4
Splunk on ARM Macs: status of KV store support? Hi all, I'm currently running arm64 version of Splunk on my M4 Mac mini, and I noticed KV store isn't available. Digg... by i0ntempest Loves-to-Learn in Deployment Architecture 03-02-2026 0 1	0	1
Heavy Forwarders not showing in Agent Management on Deployment Server I'm running Version 10.2.0, Build: d749cb17ea65 -- on RHEL 10 as a Systemd serviceI've registered 2 Heavy Forwarders... by salc Explorer in Deployment Architecture 02-26-2026 0 4	0	4
edge processor service account Hi,First time Setup of the Edge processor - Service account should this account be a password enabled or can it be a ... by Srinivasi Loves-to-Learn in Deployment Architecture 02-24-2026 0 0	0	0
Splunk servers on AWS - externalise configuration Hi we have a splunk clustered environment hosted on AWS environment. Normally we are using Ssmsessionmanager role to ... by Karthikeya Communicator in Deployment Architecture 02-23-2026 0 1	0	1
Version 10 Is there any possibility that the app could be released for Version 10? by leykevin New Member in Deployment Architecture 02-18-2026 0 2	0	2
KVStore does not start when running Splunk 9.4 ( WITH A SOLUTION ) After completing the upgrade from Splunk Enterprise version 9.3.3 to v9.4 the KVstore will no longer start. Splunk ha... by triptraptresko Path Finder in Deployment Architecture 02-17-2026 7 3	7	3
Splunk add on builder does not work Cannot read properties of undefined (reading '0') (error(s) 1/1) by AceX Loves-to-Learn Lots in Deployment Architecture 02-16-2026 0 2	0	2
Indexer Cluster Network Hello, I have a question regarding the indexer cluster, can we have 2 peers hosted in different networks / sites? Of ... by dania_abujuma Explorer in Deployment Architecture 02-16-2026 0 1	0	1
KVStore specific cert I would like to know how to properly configure my kvstore stanza to use my own self generated Server/Client authentic... by Abass42 Communicator in Deployment Architecture 02-11-2026 0 3	0	3
Multisite Cluster I’m relatively new to Splunk and currently designing my first production architecture, so I’d really appreciate your ... by msaleh7422 Engager in Deployment Architecture 02-02-2026 0 3	0	3
SPL query to group deployment config downloads Currently I'm running the following SPL to confirm the UF downloaded a new config:index=_internal sourcetype=splunkd ... by StephenD1 Path Finder in Deployment Architecture 01-23-2026 0 1	0	1
Deploy/upgrade SHC app to single search head node for testing Hello, is it possible to push/upgrade a SHC app to single search head for testing, in a production cluster?Thanks. by splunkreal Influencer in Deployment Architecture 01-19-2026 0 2	0	2
Splunk cluster in Docker / Kubernetes (Containerization) Hello, anyone had experience with containers for Splunk cluster? Does it fit SHC kvstore for instance or indexers? An... by splunkreal Influencer in Deployment Architecture 01-15-2026 0 4	0	4
Conf File Variables I'm reverse engineering UF configs from an old deploy server that we're replacing and am running into variables in co... by jdmeek Explorer in Deployment Architecture 01-14-2026 0 2	0	2
question related to search head captain Hello.I have some question about the captain selection process.(i am very new to splunk its only been 2 months so if ... by jatin3101 Engager in Deployment Architecture 01-10-2026 0 6	0	6
Splunk Data Lake support Can you clarify Splunk Data Lake support around schema (schema-on-read vs enforced), available APIs for ingest/query,... by ARC1 Loves-to-Learn in Deployment Architecture 01-04-2026 0 11	0	11
how to setup Veeam app in distributed environment Hello,Veeam App for Splunk how do you install/configure the Veeam App in a distributed environment? Search Head Clust... by Andre_ Path Finder in Deployment Architecture 12-07-2025 0 3	0	3
Deployment server not deploying apps to clients DS version 9.4.5 hi All, Got a very strange issue. DS version 9.4.5. OS rhel 8+DS is not deploying app to clients. Deploy server is e... by Singhk1 Engager in Deployment Architecture 12-02-2025 0 2	0	2
splunk_internal_telemetry:53 - Failed to send telemetry event: [HTTP 401] Client is not authenticated Hei,Getting these messages constantly: Splunk Version 9.4.0 - Running on WindowsLogFile: python.log2025-01-31 23:24:1... by robxzy New Member in Deployment Architecture 12-01-2025 0 1	0	1
Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server We are attempting to upgrade Splunk Universal Forwarders using the UF Remote Upgrade Add-on.As per Splunk documentati... by msmadhu Path Finder in Deployment Architecture 12-01-2025 0 5	0	5