Deployment Architecture

Thread Info

How to add a new index to a cluster

Hi I am new to setting up clusters and setting up a new cluster so apologies in advance if this is a simple question....

by Engager in

How to move cold and frozen buckets to a new disk?

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows ...

by New Member in

Is it possible to use a single search-head as the cluster-master with 2 indexers in a 6.2.x cluster environment?

Hello, i have got the task to design an "as-small-as-possible" cluster in our test-demo-environment According t...

by Explorer in

Why does the bucket command on _time with span=12h only return odd numbers (11:00, 23:00), not even (12:00, 24:00)?

Hi All, I am doing a simple bucketing of events and counting it. But when i bucket the events its always does it i...

by Contributor in

What are other options to allow our search head and index cluster to connect without an HTTP proxy?

Hi, We have a Search head on the other side of a WAN which needs to search against an Index cluster in a sensitive...

by Path Finder in

Is there best practices for linux server builds for splunk file systems ...

For example : /PS _INSTALL - 5GB /splunk/fsdev01 -20GB /splunk/fsdev07 -20GB

by New Member in

Can you programmattically add servers to an existing server-class?

Hi, In our private cloud, we use chef to push out Splunk configs, which to this point, have been controlled by the...

by Champion in

サーチヘッドのメモリ使用率について

サーチヘッドを5から6.1.4にアップグレードしたところ、サーチヘッドのsplunkdのメモリ使用率が毎日300MB〜400MBくらい解放されずに増え続けていますが、原因および回避策を分かる方いますでしょうか？

by Contributor in

Changing Indexer IP in Univerisal Forwader

Hi All, I need help , We have installed universal forwarder in around 20 machines and provided the deployment , In...

by Path Finder in

Field names from same DB Inputs on different indexers have different cases...

I have two indexers: one legacy where DB Connect 1.0.x was installed and updated as releases come out and another tha...

by Path Finder in

Is there a way to disable forwarding from a particular Deployment Client from within the Forwarder Management app or if not that then on the CLI?

I had an exchange server spew 8 gigabytes of logs at me in an hour (it usually sends about a gig a day). As my licens...

by Motivator in

What is required to use Forwarder Management?

I have a Splunk 6 instance running on Windows. I have no file system access, only access via Splunk Web. The instance...

by Communicator in

How to rollback buckets from cold to warm?

I have recently upgraded my indexer to have two sets of drives. SSDs are mounted on /fast and spinning rust is sittin...

by Path Finder in

Distributed Search Problems.

I have 2 Splunk instances living on Linux systems that I’ve inherited, and the one Search Head is throwing the follow...

by Builder in

Warning! Deprecated index

Hi, We have some cases were a certain solution was replaced by a newer solution (with different structure, differe...

by Explorer in

Splunk DB Connect: How to fix Java Bridge Server error "Unable to listen on localhost:17865: java.net.BindException: Address already in use"?

This is the error I see in _internal index logs main:FATAL:JavaBridgeServer - Unable to listen on localhost:17865:...

by Engager in

How to add a 'static' field to all events from a site to track data's original sources in a multisite index clustering environment?

I have a distributed Splunk installation with two sites and indexer replication between the two sites such that all d...

by Explorer in

@@@+91-9460494674@@@get back your boyfriend after break up@$# ...

mk. @@@+91-9460494674@@@get back your boyfriend after break up@$# ... @@@+91-9460494674@@@get back your boyfriend aft...

by New Member in

splunkforwarder not forwarding to sandbox with TcpOutputFd

I am having trouble getting started with a sandbox. I would love some help so I can start getting value out of splunk...

by Explorer in

Is my hardware architecture ideal for my environment?

Hello, I have a hardware architecture for my Splunk INDEX as follows: 8 CORES Xeon 2.4GHZ and 40GB RAM And for ...

by Explorer in

Splunk DB Connect: Why am I getting "Ignored stanza: batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt" in the dbx.log?

Hi getting the following entry in the dbx.log 2015-01-09 05:54:58.119 monsch1:DEBUG:Scheduler - Ignored stanza...

by Explorer in

Search Head Clustering - Deployer can't contact license master

I've recently updated my Splunk lab to begin testing 6.2 and search head clustering. All of my license slaves are com...

by Builder in

serverclass.conf: Do I need to write separate stanzas, or can I used wildcards to push apps to clients from the deployment server?

serverclass.conf I use the below config to push apps from my deployment server to the clients . sos - App has bee...

by Motivator in

Splunk 6.2 Cluster - Message - Duplicate instance name. Ensure each instance has a unique instance (host) name.

Hi there, i run into a problem with the new Distributed Management Console. When i change to the Ditributed Mode i...

by Path Finder in

I see lots of errors while searhing on searchhead: "[indexer1] The lookup table 'IPAMLookup' does not exist"

[indexer1] The lookup table 'BlogArticleMonthLookup' does not exist. It is referenced by configuration 'apache_req_bl...

by New Member in

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Deployment Architecture

Discussions

How to add a new index to a cluster

How to move cold and frozen buckets to a new disk?

Is it possible to use a single search-head as the cluster-master with 2 indexers in a 6.2.x cluster environment?

Why does the bucket command on _time with span=12h only return odd numbers (11:00, 23:00), not even (12:00, 24:00)?

What are other options to allow our search head and index cluster to connect without an HTTP proxy?

Is there best practices for linux server builds for splunk file systems ...

Can you programmattically add servers to an existing server-class?

サーチヘッドのメモリ使用率について

Changing Indexer IP in Univerisal Forwader

Field names from same DB Inputs on different indexers have different cases...

Is there a way to disable forwarding from a particular Deployment Client from within the Forwarder Management app or if not that then on the CLI?

What is required to use Forwarder Management?

How to rollback buckets from cold to warm?

Distributed Search Problems.

Warning! Deprecated index

Splunk DB Connect: How to fix Java Bridge Server error "Unable to listen on localhost:17865: java.net.BindException: Address already in use"?

How to add a 'static' field to all events from a site to track data's original sources in a multisite index clustering environment?

@@@+91-9460494674@@@get back your boyfriend after break up@$# ...

splunkforwarder not forwarding to sandbox with TcpOutputFd

Is my hardware architecture ideal for my environment?

Splunk DB Connect: Why am I getting "Ignored stanza: batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt" in the dbx.log?

Search Head Clustering - Deployer can't contact license master

serverclass.conf: Do I need to write separate stanzas, or can I used wildcards to push apps to clients from the deployment server?

Splunk 6.2 Cluster - Message - Duplicate instance name. Ensure each instance has a unique instance (host) name.

I see lots of errors while searhing on searchhead: "[indexer1] The lookup table 'IPAMLookup' does not exist"

See your relevant APM services, dashboards, and alerts in one place with the updated ...

Index This | What goes away as soon as you talk about it?

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

Offline Logging and oberservability - on permises

v0.116.0 upgrade for EKS cluster gives webhook err...

Does a props/transforms.conf Visio stencil exist?

My servers class Agent allways in Pending status

splunk_internal_telemetry:53 - Failed to send tele...

Deployment Architecture

Are you a member of the Splunk Community?

Discussions