Deployment Architecture

Community Activity

Using the bucket command, why doesn't one bucket range appear? I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1... by rana_nour Explorer in Deployment Architecture 07-13-2015 0 3	0	3
splunkd and splunkweb are up for a cluster peer, but why is it repetitively downloading the cluster bundle with the following errors? We have clustered environment Version : v6.1.1 1 x CM (Multi-Site, rf=2, site_rf=origin:1,site1:1,site2:1,total:2,... by sat94541 Communicator in Deployment Architecture 07-12-2015 1 1	1	1
Possible to add linux search peer with Putty key and without username or password? Hello, I am trying to add another search peer to my search head, through the Settings > Distributed Search menu. I d... by RecoMark0 Path Finder in Deployment Architecture 07-09-2015 1 4	1	4
Migrating to a distributed search architecture, is it required to change the distributed management console from standalone to distributed? We are migrating from 2 x split indexers (standalone) instances to 2 x split indexers and a dedicated search head / ... by JabawokJayUK Engager in Deployment Architecture 07-09-2015 0 12	0	12
Deployment Server vs. Deployer I am having a hard time trying to understand the difference between the two. I wonder if Splunk can make future name ... by shandman Path Finder in Deployment Architecture 07-09-2015 3 3	3	3
Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server? Good morning. We are (finally) looking to upgrade and add a second indexer in the mix. Our current setup is the foll... by hagjos43 Contributor in Deployment Architecture 07-09-2015 0 8	0	8
More than 100 “EventID=8306 sourcetype="xyz"” in 15 minutes on an individual host base i want an alert setup in splunk for 100 occurrence of event id 8306 per host for sourcetype "xyz" in 15 minutes.. C... by mvishal Explorer in Deployment Architecture 07-08-2015 0 1	0	1
Has anyone scaled Splunk across a multisite deployment? How has it worked out for you and are there capacity planning tips? Hello, I am trying to start a new Splunk project. I have 3 sites across the U.S. I would like to implement Splunk. E... by mmensch Path Finder in Deployment Architecture 07-07-2015 0 8	0	8
Why are my 3 search heads in a search head clustering environment filling up the directory "/opt/splunk/var/lib/splunk/kvstore/mongo"? I'm currently building out a Splunk environment and could do with some help. The three search heads (clustered) are... by harrymclaren Explorer in Deployment Architecture 07-07-2015 1 3	1	3
How to Get Edits to "Take"? I've used the information previously posted to manually update some XML files in an application and then to restart s... by gmark Explorer in Deployment Architecture 07-02-2015 0 1	0	1
Host-specific files with Deployment Server Hi. After getting tired of managing 20 individual lightforwarders and one indexer, I've decided to make use of the De... by Branden Builder in Deployment Architecture 07-01-2015 1 5	1	5
Can we enable shared KV store with Search Head Pooling (not clustering)? We're not ready to apply Search Head Clustering yet, but we're on Search Head Pooling now. Can we apply KV store quic... by philip_wong Communicator in Deployment Architecture 06-30-2015 0 3	0	3
Why does the bucket command show 3 rows when bin=4, but 1 row when bin=3? when I use the following: index= _internal \| bucket size bins=3 \|stats count(_raw) by size I see: size----------... by pramit46 Contributor in Deployment Architecture 06-30-2015 0 4	0	4
Is there a curl command to execute a rolling restart in a search head cluster? From the docs http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/RestartSHC One has to identify the search... by ben_leung Builder in Deployment Architecture 06-29-2015 1 2	1	2
How to update the search head configuration from the cluster master? I'm trying to update the configuration of all the peers from my cluster master. With the indexers, it's eash to put t... by mciudad Explorer in Deployment Architecture 06-29-2015 0 1	0	1
Why are we getting "Replication factor not met" in our multisite indexer clustering environment? We have configured multisite indexer clustering (2 peers at each site1/2 and one search head at site 1) with the belo... by darshan_singh01 Path Finder in Deployment Architecture 06-28-2015 0 7	0	7
Splunk DB connect: How to change maximum size per event Environments: Windows Server 2008 R2, Splunk 6.2.3, DB connect 1.2, JRE8, MSSQL There are some events of more than 1... by sj0man Engager in Deployment Architecture 06-28-2015 0 2	0	2
If I have a replication factor of 3, when data rolls to frozen, will it store 3 copies of the same frozen bucket? I have been searching for hours and have, so far, come up empty. If I have a RF=3 and SF=3, when data rolls to my fro... by jordanperks Path Finder in Deployment Architecture 06-26-2015 0 3	0	3
Server.conf serverName variables I am trying to develop a standardized version of server.conf to deploy to all my forwarders. In a Windows environmen... by agodoy Communicator in Deployment Architecture 06-26-2015 0 1	0	1
Splunk Architecture for two servers Hello All, I have two high-performance servers for Splunk in different segments. The first server will receive data ... by apakhomov Path Finder in Deployment Architecture 06-26-2015 0 9	0	9
How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)? Hello, I have been working on Splunk for some time and have seen its use for server/application monitoring. I have b... by manmah4u Explorer in Deployment Architecture 06-26-2015 1 4	1	4
Search head clustering with multisite indexing cluster - What happens when main site goes down? Hi, I'm designing a new Splunk solution based on Search head clustering on top of a multi site indexing cluster. (a... by jofe Explorer in Deployment Architecture 06-25-2015 2 2	2	2
LEA Client doesn't connect to Check Point OPSEC LEA Server I am getting the errors below when i try to made a new connection to a checkpoint log server my opsec.log 2015-06-2... by d646800 Explorer in Deployment Architecture 06-25-2015 0 4	0	4
Syncing dashboards and alerts on multi search head architecture We're in the process of doing a major upgrade to our Splunk environment. We're effectively moving from a single insta... by grahamrb Explorer in Deployment Architecture 06-24-2015 1 2	1	2
Forwarder not appearing in unix app Hi, I have a universal forwarder that sends information to my indexer. Both have the *nix app installed. From the de... by ylsul Explorer in Deployment Architecture 06-24-2015 1 3	1	3

Get Updates on the Splunk Community!

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Deployment Architecture

Using the bucket command, why doesn't one bucket range appear?

splunkd and splunkweb are up for a cluster peer, but why is it repetitively downloading the cluster bundle with the following errors?

Possible to add linux search peer with Putty key and without username or password?

Migrating to a distributed search architecture, is it required to change the distributed management console from standalone to distributed?

Deployment Server vs. Deployer

Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server?

More than 100 “EventID=8306 sourcetype="xyz"” in 15 minutes on an individual host base

Has anyone scaled Splunk across a multisite deployment? How has it worked out for you and are there capacity planning tips?

Why are my 3 search heads in a search head clustering environment filling up the directory "/opt/splunk/var/lib/splunk/kvstore/mongo"?

How to Get Edits to "Take"?

Host-specific files with Deployment Server

Can we enable shared KV store with Search Head Pooling (not clustering)?

Why does the bucket command show 3 rows when bin=4, but 1 row when bin=3?

Is there a curl command to execute a rolling restart in a search head cluster?

How to update the search head configuration from the cluster master?

Why are we getting "Replication factor not met" in our multisite indexer clustering environment?

Splunk DB connect: How to change maximum size per event

If I have a replication factor of 3, when data rolls to frozen, will it store 3 copies of the same frozen bucket?

Server.conf serverName variables

Splunk Architecture for two servers

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Search head clustering with multisite indexing cluster - What happens when main site goes down?

LEA Client doesn't connect to Check Point OPSEC LEA Server

Syncing dashboards and alerts on multi search head architecture

Forwarder not appearing in unix app

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation