Deployment Architecture

Community Activity

KVStore does not start when running Splunk 9.4 I am posting this to maybe save you from few hours of troubleshooting like I did.I did clean install of Splunk 9.4 in... by MaverickT Communicator in Deployment Architecture 09-22-2025 0 7	0	7
Is there a limit to how many Search Heads can be part of a Cluster? Is there a limit to how many Search Heads can be part of a Cluster? We have a fairly large deployment and I wanted t... by katelynengel Explorer in Deployment Architecture 09-19-2025 1 8	1	8
How i can remove unused fields in extracted fields using "Delimiters" ? Hi all,I’m extracting fields from an event using the Field Extractor with a pipe (\|) delimiter for sourcetype=alert:a... by zksvc Contributor in Deployment Architecture 09-19-2025 0 3	0	3
Remote Upgrader for linux uf I have already deliver the splunk remote upgrader tgz ,with depoyment server.Can i deliver a script too to automatica... by ShawnXie Loves-to-Learn in Deployment Architecture 09-17-2025 0 5	0	5
Splunk Monitoring Console HA Set-up Hi,I have a requirement to implement the Splunk Monitoring Console (DMC) in a High Availability (HA) setup. At presen... by srek3502 Explorer in Deployment Architecture 09-10-2025 0 5	0	5
KVStore does not start when running Splunk 9.4 ( WITH A SOLUTION ) After completing the upgrade from Splunk Enterprise version 9.3.3 to v9.4 the KVstore will no longer start. Splunk ha... by triptraptresko Path Finder in Deployment Architecture 09-10-2025 5 2	5	2
inflight file clean up In my indexer cluster, one of my indexers has inflight files in the cold and warm storage that range from 1.5-2 month... by huynha Explorer in Deployment Architecture 09-05-2025 1 4	1	4
SC4S vs “syslog servers tier” Why SC4S over a generic “syslog servers tier”1. It is Splunk’s best practice todaySplunk Validated Architectures call... by DanAlexander Communicator in Deployment Architecture 09-03-2025 0 1	0	1
Deployment Server: Duplicate clients after reinstalling the UF Hi I hope you are doing well. I have reinstalled the UF after that i found there are duplicate clients on the Deploym... by AliMaher Path Finder in Deployment Architecture 08-28-2025 0 4	0	4
Can universal forwarders have 2 different deployment server IPs in case the first fails? I have UFs in the DMZ and internal networks with a load balancer managing traffic between both zones. There is a sing... by StephenD1 Path Finder in Deployment Architecture 08-25-2025 0 8	0	8
splunkforwarder 9.x requires tty enabled in k8s sidecar? Hello folks,We are doing splunkforwarder upgrade to 9.4.x (from 8.x) recently, we build the splunk sidecar image for ... by kevinhsu New Member in Deployment Architecture 08-25-2025 0 1	0	1
Search head keeps failing in search head cluster This was the search head that kept failing: splunk > /appl/splunk/bin/splunk show shcluster-status -auth admin:admin... by zzhao05 New Member in Deployment Architecture 08-11-2025 0 5	0	5
Settings for 1year retention period I have this small Splunk Enterprise deployment in a lab that's air gapped.So I setup this deployment about 18 months ... by jkamdar Communicator in Deployment Architecture 08-06-2025 0 5	0	5
How can I deploy the TA_nix on the deployment server? What would be the proper way to deploy the TA_nix on the deployment server, is the reload option available or do I ne... by danielbb Motivator in Deployment Architecture 08-05-2025 0 5	0	5
How does the deployment server deploy to itself? I have two DSs that fail to deploy the TA_nix to themselves, how is it normally done? meaning how does the deployment... by danielbb Motivator in Deployment Architecture 08-04-2025 0 6	0	6
UBA Installation LVM Volume management Hi Everyone,I am in the process of installing Splunk UBA and have a question regarding the storage partitioning requi... by zksvc Contributor in Deployment Architecture 07-31-2025 0 6	0	6
Splunk Primary data not auto rolled to secondary after configuration change I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce ... by elend Communicator in Deployment Architecture 07-24-2025 0 8	0	8
Why drilldown using all-time in Enterprise Security Incident Review Hi Everyone, in default correlation search the name "Excessive Failed Logins" my drilldown cannot define $info_min_ti... by zksvc Contributor in Deployment Architecture 07-22-2025 3 10	3	10
UFW Access to WinEventLogs Hello All,We have a Splunk Universal Forwarder 9.4.0 (then 9.4.3) installed on a Windows 2022 box to which we don't h... by tsocyberoperati Loves-to-Learn Lots in Deployment Architecture 07-21-2025 0 5	0	5
The Client forwarder management not showing the clients Dears, After upgraded Splunk from 9.1.2 version to 9.2.0 version, the deployment server not showing the clients... by AAlhabba Explorer in Deployment Architecture 07-21-2025 1 29	1	29
Questions about data retention in Splunk Cloud (DDAS, DDAA) Hello! I'm new to Splunk Cloud. Could you please explain the difference between hot, warm, cold and thawed buckets in... by azer271 Path Finder in Deployment Architecture 07-20-2025 0 4	0	4
How to move index from one hard drive to another in Splunk clustered environment? Hi everyone, I am working on Splunk clustered environment, where i have 3 indexers,1 search head, and 1 head. Now i a... by thambisetty SplunkTrust in Deployment Architecture 07-18-2025 3 13	3	13
what is ExecStartPost in systemd unit itended for? Hi all,When creating a systemd unit file for and old UF (<9.1) using "splunk enable boot-start -systemd-managed 1 -us... by schose Builder in Deployment Architecture 07-15-2025 0 2	0	2
Heavy Forwarder Not Indexing My End Goal: I would like to be able to leverage our windows Splunk deployment server/Splunk enterprise server to rec... by Cole-Potter Loves-to-Learn Lots in Deployment Architecture 07-14-2025 0 5	0	5
Is it possible to encrypt an index in my Splunk instance? I have a group of indexes, one of which contains sensitive data that must be encrypted so that no one can copy and up... by spy_jr Explorer in Deployment Architecture 07-14-2025 0 6	0	6