Deployment Architecture

Community Activity

will mix of FIPS and non FIPS servers still work? (not sure what forum location/message board to use)I currently have a non FIPS - RHEL 8 Single Site Distributed Clust... by Darthsplunker Path Finder in Deployment Architecture 03-26-2026 0 4	0	4
Indexing Huawei Firewall device logs into Splunk Hi,I am trying to ingest huawei USG6650 device logs but it seems that no app is available in splunk base for this pur... by eidil Explorer in Deployment Architecture 03-26-2026 1 6	1	6
Evaluation Setup for Spunk ES Questions - All components under one Windows VM Hi, I'm gathering requirements for an evaluation setup for Splunk platform with Enterprise Security.Would it be possi... by acisac Explorer in Deployment Architecture 03-26-2026 0 7	0	7
Splunk 10.2.x \| RHEL 8 \| SPL2 disable or exposure IHAC that is eager to take advantage of the new Splunk Enterprise 10.2 release, they are currently on 10.0.3 and have... by NullZero Communicator in Deployment Architecture 03-25-2026 0 2	0	2
Add Data - only default indexes I have a distributed deployment with a SHC and a IC. I have added the index to the manager and pushed the new index ... by detrue New Member in Deployment Architecture 03-22-2026 0 2	0	2
Can we downsize our indexer cluster? We are at 10 indexers ingesting around 400 GBs/day. A homogeneous environment with 1 millisecond wait time (I/O Write... by LovingSplunk Path Finder in Deployment Architecture 03-20-2026 0 12	0	12
How do I clear old indexers' bundles? On my indexers I have many bundles that are very old (some over 1 year old). What is the best way to configure Splunk... by LovingSplunk Path Finder in Deployment Architecture 03-13-2026 0 3	0	3
Change Universal Forwarder host/servername Hi,I work with a distributed Splunk Enterprise architecture and I am trying to update how some Universal Forwarder sh... by prusconi New Member in Deployment Architecture 03-11-2026 0 1	0	1
Cisco Enhanced Netflow Add-On Insanity Hello guys,I am currently banging my head on the wall trying to understand and deploy the "Cisco Catalyst Enhanced Ne... by lbertini New Member in Deployment Architecture 03-09-2026 0 0	0	0
How come the license master is configured as a search peer to the search head? I get this vulnerability log from the search head -/opt/splunk/var/run/searchpeers/<license-master-hostname>-17710294... by LovingSplunk Path Finder in Deployment Architecture 03-05-2026 0 4	0	4
Splunk on ARM Macs: status of KV store support? Hi all, I'm currently running arm64 version of Splunk on my M4 Mac mini, and I noticed KV store isn't available. Digg... by i0ntempest Loves-to-Learn in Deployment Architecture 03-02-2026 0 1	0	1
Heavy Forwarders not showing in Agent Management on Deployment Server I'm running Version 10.2.0, Build: d749cb17ea65 -- on RHEL 10 as a Systemd serviceI've registered 2 Heavy Forwarders... by salc Explorer in Deployment Architecture 02-26-2026 0 4	0	4
edge processor service account Hi,First time Setup of the Edge processor - Service account should this account be a password enabled or can it be a ... by Srinivasi Loves-to-Learn in Deployment Architecture 02-24-2026 0 0	0	0
Splunk servers on AWS - externalise configuration Hi we have a splunk clustered environment hosted on AWS environment. Normally we are using Ssmsessionmanager role to ... by Karthikeya Communicator in Deployment Architecture 02-23-2026 0 1	0	1
Version 10 Is there any possibility that the app could be released for Version 10? by leykevin New Member in Deployment Architecture 02-18-2026 0 2	0	2
KVStore does not start when running Splunk 9.4 ( WITH A SOLUTION ) After completing the upgrade from Splunk Enterprise version 9.3.3 to v9.4 the KVstore will no longer start. Splunk ha... by triptraptresko Path Finder in Deployment Architecture 02-17-2026 7 3	7	3
Splunk add on builder does not work Cannot read properties of undefined (reading '0') (error(s) 1/1) by AceX Loves-to-Learn Lots in Deployment Architecture 02-16-2026 0 2	0	2
Indexer Cluster Network Hello, I have a question regarding the indexer cluster, can we have 2 peers hosted in different networks / sites? Of ... by dania_abujuma Explorer in Deployment Architecture 02-16-2026 0 1	0	1
KVStore specific cert I would like to know how to properly configure my kvstore stanza to use my own self generated Server/Client authentic... by Abass42 Communicator in Deployment Architecture 02-11-2026 0 3	0	3
Multisite Cluster I’m relatively new to Splunk and currently designing my first production architecture, so I’d really appreciate your ... by msaleh7422 Engager in Deployment Architecture 02-02-2026 0 3	0	3
SPL query to group deployment config downloads Currently I'm running the following SPL to confirm the UF downloaded a new config:index=_internal sourcetype=splunkd ... by StephenD1 Path Finder in Deployment Architecture 01-23-2026 0 1	0	1
Deploy/upgrade SHC app to single search head node for testing Hello, is it possible to push/upgrade a SHC app to single search head for testing, in a production cluster?Thanks. by splunkreal Influencer in Deployment Architecture 01-19-2026 0 2	0	2
Splunk cluster in Docker / Kubernetes (Containerization) Hello, anyone had experience with containers for Splunk cluster? Does it fit SHC kvstore for instance or indexers? An... by splunkreal Influencer in Deployment Architecture 01-15-2026 0 4	0	4
Conf File Variables I'm reverse engineering UF configs from an old deploy server that we're replacing and am running into variables in co... by jdmeek Explorer in Deployment Architecture 01-14-2026 0 2	0	2
question related to search head captain Hello.I have some question about the captain selection process.(i am very new to splunk its only been 2 months so if ... by jatin3101 Engager in Deployment Architecture 01-10-2026 0 6	0	6