Deployment Architecture

Discussions

Thread Info

How do I roll buckets to frozen by # of days?

I would like to keep data for an index around for no longer than 6 months. Is there a setting to do this or can I onl...

by Communicator in

Can you use both mounted and shared bundles with the same index cluster?

I have a dedicated search pool using mounted bundles to talk to our index cluster. Can I also have a standalone se...

by Path Finder in

Why can't I see indexes from the search head after enabling Index Clustering?

Details: - 3 x Indexers - 1 x Cluster Master - 1 x Search head - 1 x Deployment server - All running 6.2.0 I creat...

by Explorer in

DB Connect in a Clustered Environment: Why am I getting missing python script errors, failed configuration bundle distribution and duplicate data?

We have a master cluster, 2 search heads and 2 indexers in our setup. We have done development on a standalone server...

by Path Finder in

Is it possible to use one deployment server instance as a deployment client??

I have multiple environments configured with Splunk (Say DEV, Testing,UAT and PROD). My DEV environment has one Searc...

by Revered Legend in

How can I get a complete list of processes used by Splunk for Linux?

I am using 6.2.1 on Linux and we need a list of all processes that are used by splunk. I could find below list for wi...

by Contributor in

Backup of indexed data in cluster with two nodes and replication factor = 2

Hi, we have a multisite indexers cluster with two nodes and replication factor = 2. All instances are running Splu...

by Path Finder in

Splunk DB Connect: Why are events from before a certain date coming in with a timestamp as today's date instead?

Hi, I have configured a Database Input as below: [dbmon-tail://MIMAS/DI-MBT-LAB_ScanBadge] host = plxs_a_sb ind...

by Contributor in

Can i change phoneHomeIntervalInSecs setting dynamically

I would like to know if I can change the phoneHomeIntervalInSecs time in sec dynamically or do i need to do a restart...

by Explorer in

What is the process to move an infrastructure from virtual machines to physical machines in our Splunk 6.1.3 environment?

Dear All, We have two production search heads, three indexers clustered, a cluster master, and a deployment server...

by Contributor in

Clustering: Can a cluster master also act as a search head?

My current splunk (standalone) index/search host has a bunch of proc/mem but is low on disk. I have two other servers...

by Explorer in

How to add a new index to a cluster

Hi I am new to setting up clusters and setting up a new cluster so apologies in advance if this is a simple question....

by Engager in

How to move cold and frozen buckets to a new disk?

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows ...

by New Member in

Is it possible to use a single search-head as the cluster-master with 2 indexers in a 6.2.x cluster environment?

Hello, i have got the task to design an "as-small-as-possible" cluster in our test-demo-environment According t...

by Explorer in

Why does the bucket command on _time with span=12h only return odd numbers (11:00, 23:00), not even (12:00, 24:00)?

Hi All, I am doing a simple bucketing of events and counting it. But when i bucket the events its always does it i...

by Contributor in

What are other options to allow our search head and index cluster to connect without an HTTP proxy?

Hi, We have a Search head on the other side of a WAN which needs to search against an Index cluster in a sensitive...

by Path Finder in

Is there best practices for linux server builds for splunk file systems ...

For example : /PS _INSTALL - 5GB /splunk/fsdev01 -20GB /splunk/fsdev07 -20GB

by New Member in

Can you programmattically add servers to an existing server-class?

Hi, In our private cloud, we use chef to push out Splunk configs, which to this point, have been controlled by the...

by Champion in

サーチヘッドのメモリ使用率について

サーチヘッドを5から6.1.4にアップグレードしたところ、サーチヘッドのsplunkdのメモリ使用率が毎日300MB〜400MBくらい解放されずに増え続けていますが、原因および回避策を分かる方いますでしょうか？

by Contributor in

Changing Indexer IP in Univerisal Forwader

Hi All, I need help , We have installed universal forwarder in around 20 machines and provided the deployment , In...

by Path Finder in

Field names from same DB Inputs on different indexers have different cases...

I have two indexers: one legacy where DB Connect 1.0.x was installed and updated as releases come out and another tha...

by Path Finder in

Is there a way to disable forwarding from a particular Deployment Client from within the Forwarder Management app or if not that then on the CLI?

I had an exchange server spew 8 gigabytes of logs at me in an hour (it usually sends about a gig a day). As my licens...

by Motivator in

What is required to use Forwarder Management?

I have a Splunk 6 instance running on Windows. I have no file system access, only access via Splunk Web. The instance...

by Communicator in

How to rollback buckets from cold to warm?

I have recently upgraded my indexer to have two sets of drives. SSDs are mounted on /fast and spinning rust is sittin...

by Path Finder in

Distributed Search Problems.

I have 2 Splunk instances living on Linux systems that I’ve inherited, and the one Search Head is throwing the follow...

by Builder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

How do I roll buckets to frozen by # of days?

Can you use both mounted and shared bundles with the same index cluster?

Why can't I see indexes from the search head after enabling Index Clustering?

DB Connect in a Clustered Environment: Why am I getting missing python script errors, failed configuration bundle distribution and duplicate data?

Is it possible to use one deployment server instance as a deployment client??

How can I get a complete list of processes used by Splunk for Linux?

Backup of indexed data in cluster with two nodes and replication factor = 2

Splunk DB Connect: Why are events from before a certain date coming in with a timestamp as today's date instead?

Can i change phoneHomeIntervalInSecs setting dynamically

What is the process to move an infrastructure from virtual machines to physical machines in our Splunk 6.1.3 environment?

Clustering: Can a cluster master also act as a search head?

How to add a new index to a cluster

How to move cold and frozen buckets to a new disk?

Is it possible to use a single search-head as the cluster-master with 2 indexers in a 6.2.x cluster environment?

Why does the bucket command on _time with span=12h only return odd numbers (11:00, 23:00), not even (12:00, 24:00)?

What are other options to allow our search head and index cluster to connect without an HTTP proxy?

Is there best practices for linux server builds for splunk file systems ...

Can you programmattically add servers to an existing server-class?

サーチヘッドのメモリ使用率について

Changing Indexer IP in Univerisal Forwader

Field names from same DB Inputs on different indexers have different cases...

Is there a way to disable forwarding from a particular Deployment Client from within the Forwarder Management app or if not that then on the CLI?

What is required to use Forwarder Management?

How to rollback buckets from cold to warm?

Distributed Search Problems.

Advanced Splunk Data Management Strategies

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

Offline Logging and oberservability - on permises

v0.116.0 upgrade for EKS cluster gives webhook err...

Does a props/transforms.conf Visio stencil exist?

My servers class Agent allways in Pending status

splunk_internal_telemetry:53 - Failed to send tele...