Deployment Architecture

Discussions

Thread Info

Replicated indexes not fully searchable - Mixed Cluster Environment

I’m running a mixed cluster where my CM is 6.2.2 and my indexer peers are all running 6.1.4. One of the peers in the ...

by Splunk Employee in

Powershell script output ingestion

I have deployed an app via our deployment server. The app includes a batch file that runs the following command: p...

by Contributor in

How to fix Linux proxy issue?

I am currently running on Red Hat Enterprise Linux. I have already set up the proxy by using the following commands: ...

by New Member in

After removing a temporary search head without removing it first as a search head cluster member, how to troubleshoot error "CONFIGURATION ID MISMATCH"?

Hey Experts, I have a cluster setup with 3 search heads and 1 deployer. Out of the three search heads, one was te...

by Motivator in

What kind of access role is required to run reload deploy-server?

Hi /opt/splunk/bin/splunk reload deploy-server -class classname While i am trying to reload deploy-server, i a...

by Path Finder in

Where exactly and how is the data stored in splunk?

I wanted to know if I am getting the data from some stream say TCP stream, where is the data stored? As I understand ...

by Builder in

bucket error "Leaving it in PendingDiscard state."

I'm looking for documentation about the following error: "Discarding bid=foo~0~60F537A5-5D22-4F24-81FD-00054499129...

by Explorer in

Why do I keep getting prompted for a username and password trying to add a member to a search head cluster?

I am trying to add a new member to a search head cluster. Init the server with: $SPLUNK_HOME/bin/splunk init sh...

by Splunk Employee in

splunk indexer restart network

Hi SPlunkers, Good day! I have a RF=3 and SF=3. I also have a forwarder which is doing the load balance forwarding...

by Communicator in

After installing Splunk on Red Hat Linux 6, why can't I access the Splunk Web interface?

I installed Splunk on Red Hat 6 Install said completed ok ... But server does not respond to http://host:8000 reques...

by New Member in

What is the difference between splunkagent and splunkforwarder?

splunk and splunkforwarder

by Contributor in

client connecting issue when only TLS is enabled

Hi, we have an environmet and due to the POODLE vulnerability that was present on port 8089 on the server we have ...

by Communicator in

Is it possible to push system/local/ui-prefs.conf from the deployer to the Search Head Cluster?

Is it possible to push system/local/ui-prefs.conf from the deployer to the SHC? Is it as simple as creating shcluster...

by Communicator in

How to change parameters of index which contains data

Hello! I have index in cluster which has data. And i need to change frozenTimePeriodInSecs and maxTotalDataSizeMB par...

by Engager in

where are the pop up message is splunk getting stored

Hello, As per the below screen shot can you please tell me which log file captures this error message : "splunk mu...

by Path Finder in

Compatibility between forwarders and indexers

Hi Guys, I could do with upgrading all our forwarders, mainly 5.0.2 on Windows to the latest forwarder build 6.2.2...

by Communicator in

FAILED LOAD DEPLOYMENT _SERVER_ TENANT default

Got this message after upgrading Deployment Server from 5.0.1 to 6.0. Any ideas on what this might be?

by Path Finder in

How to set the bucket retention policy for 2 months before automatically deleting the data?

Hi, I'd like to set the Bucket time to keep data for 2 months and then to automatically remove it. how do I do ...

by New Member in

Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

Rather than forwarding logs from the proxy server (Bluecoat), I would ideally like to see a SplunkLWF on a server tha...

by Contributor in

DB Connect options/alternatives for SQL Server and Java 8?

After much trial and tribulation, i discovered that DB Connect is not compatible with Java 8, at least for MS SQL Ser...

by Engager in

Splunk DB Connect 1: Why dbquery "select original_column_name AS new_column_name" is not working?

I am using dbquery to join two tables and display the results. Unfortunately, both tables use the column "NAME" I ...

by Motivator in

Using foreach and dbquery, why am I getting error "'foreach' command: Search pipeline may not contain non-streaming commands"?

Hi everybody This error is causing me problems. From a result set (a table with a "name" field) I want to run this...

by Engager in

In a properly configured and operating splunk set-up to forward the internal events of a search-head cluster to an index cluster, what kind of log entries should be occurring, in which logs, and on which components of a distributed splunk deployment?

I have been trying to troubleshoot my deployment which is not currently working properly (receiving on-going Search p...

by Communicator in

How do I restrict searches to specific search peers by default and in saved and scheduled searches?

I have recently added an independent search head which performs distributed searches using two different search peers...

by Explorer in

Has anyone upgraded from a 6.0.X distributed search environment with search head pooling to 6.2.X with search head clustering?

Has anyone experienced upgrading from a distributed search environment with search head pooling to the new version 6....

by Builder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Replicated indexes not fully searchable - Mixed Cluster Environment

Powershell script output ingestion

How to fix Linux proxy issue?

After removing a temporary search head without removing it first as a search head cluster member, how to troubleshoot error "CONFIGURATION ID MISMATCH"?

What kind of access role is required to run reload deploy-server?

Where exactly and how is the data stored in splunk?

bucket error "Leaving it in PendingDiscard state."

Why do I keep getting prompted for a username and password trying to add a member to a search head cluster?

splunk indexer restart network

After installing Splunk on Red Hat Linux 6, why can't I access the Splunk Web interface?

What is the difference between splunkagent and splunkforwarder?

client connecting issue when only TLS is enabled

Is it possible to push system/local/ui-prefs.conf from the deployer to the Search Head Cluster?

How to change parameters of index which contains data

where are the pop up message is splunk getting stored

Compatibility between forwarders and indexers

FAILED LOAD DEPLOYMENT _SERVER_ TENANT default

How to set the bucket retention policy for 2 months before automatically deleting the data?

Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

DB Connect options/alternatives for SQL Server and Java 8?

Splunk DB Connect 1: Why dbquery "select original_column_name AS new_column_name" is not working?

Using foreach and dbquery, why am I getting error "'foreach' command: Search pipeline may not contain non-streaming commands"?

In a properly configured and operating splunk set-up to forward the internal events of a search-head cluster to an index cluster, what kind of log entries should be occurring, in which logs, and on which components of a distributed splunk deployment?

How do I restrict searches to specific search peers by default and in saved and scheduled searches?

Has anyone upgraded from a 6.0.X distributed search environment with search head pooling to 6.2.X with search head clustering?

October Community Champions: A Shoutout to Our Contributors!

Community Content Calendar, November Edition

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Offline Logging and oberservability - on permises

v0.116.0 upgrade for EKS cluster gives webhook err...

Deployment Architecture

Are you a member of the Splunk Community?

Discussions