Deployment Architecture

Community Activity

DB Connect: Why am I getting errors trying to specify EVENT_TIMESTAMP as the rising column to pull audit data from Oracle? I'm trying to pull Oracle SYS.UNIFIED_AUDIT_TRAIL table with DB Connect. The rising column should be EVENT_TIMESTAMP,... by bojanz Communicator in Deployment Architecture 03-17-2015 3 1	3	1
In a multisite indexer cluster, how can we verify that each peer does not get more than one copy? I have set up a Splunk indexer cluster on AWS using the multisite feature. The cluster is spread across 2 AZs. Each A... by rashmigonchikar Engager in Deployment Architecture 03-16-2015 0 1	0	1
After upgrade to 6.2.1 from 6.1.5, why am I getting error "Could not write to auth token file" trying to run: splunk reload deploy-server? Upgraded from 6.1.5 to 6.2.1 and now when I attempt to run splunk reload deploy-server I get this error message D:\S... by stemo76 Explorer in Deployment Architecture 03-16-2015 1 6	1	6
how to manage large quantity of forwarders? Let's say there is an splunk enterprise instance and 10 splunk forwarders. I would like to enable and disable some sp... by yhjhoo New Member in Deployment Architecture 03-15-2015 0 3	0	3
Splunk DB Connect: Why am I getting an error on my heavy forwarder trying to add a PostgreSQL database? I'm having issues with adding a PostgreSQL db using dbconnect. I've used a couple of guides without luck. I was hopin... by cbeard604 Explorer in Deployment Architecture 03-15-2015 0 1	0	1
Search returns zero results - search.log reports "DistributedSearchResultCollectionManager - Not connecting to peer" The problem: I added new nodes to an index cluster by mistake. After removing them, I found that searches from the s... by halr9000 Motivator in Deployment Architecture 03-13-2015 5 1	5	1
Moving indexes to a new Splunk server I'm retiring an old Splunk server and replacing it with two new Splunk servers and I have some questions regarding th... by erga00 Path Finder in Deployment Architecture 03-12-2015 7 4	7	4
How do you handle deployments in search head clustering if you are no longer able to use a deployment server? We read that once you enable search head clustering in splunk 6.2 you are no longer able to use a deployment server. ... by mookiie2005 Communicator in Deployment Architecture 03-12-2015 1 2	1	2
Can i have 2 deployment server in 1 Linux OS computer? by xiyangyang Path Finder in Deployment Architecture 03-12-2015 0 2	0	2
What credentials should be used when initializing the deployer when setting up a search head cluster in enterprise 6.2.2? I have tried user=splunk and the password that I changed for splunk but this throws a login failed error when using s... by transtrophe Communicator in Deployment Architecture 03-12-2015 1 6	1	6
How to change deploy-poll atomatically? We have 2 deployment-servers. One is Windows which manage about 1500 Windows client servers. One is Linux which manag... by xiyangyang Path Finder in Deployment Architecture 03-12-2015 0 1	0	1
What does this event mean? " WARN DistributedBundleReplicationManager - bundle replication to 24 peer(s) took too long" I'm working to improve search performance in my 4SH SHP environment with 24 indexers. We are seeing many of these ev... by mctester Communicator in Deployment Architecture 03-10-2015 3 4	3	4
How to promote an App from Development to QA then to Production? In our case, Splunk apps needs to be promoted from DEV->TEST->QA->PERFOMANCE->PROD Our DEV instance is tied to versi... by koshyk Super Champion in Deployment Architecture 03-10-2015 0 2	0	2
Indexer clustering setup with AWS EC2: How to fix error "the peer cannot connect with the master because the master_uri or secret key are wrong or invalid?" I am just starting use of Splunk Enterprise using AWS EC2. I Have 1 Search Head running on a Windows AMI, 1 Master In... by transtrophe Communicator in Deployment Architecture 03-09-2015 0 2	0	2
When your universal forwarder runs as root, should all of your apps run as root? If so, does that mean your deployment server should run as root also? It keeps deploying client apps as "splunk" by campbellj1977 Explorer in Deployment Architecture 03-09-2015 0 1	0	1
Splunk DB Connect: If two Splunk servers create a database input from TableA, will this cause duplicates to be indexed? If two Splunk server create a Database input from table A, will this cause any conflict? Will both Server1 and Server... by oraclebox Explorer in Deployment Architecture 03-09-2015 0 2	0	2
Is the deployer part of the search head cluster? Hi, In SHC, is the Deployer considered part of the cluster? Should I run the "init schcluster-config" commands on t... by a212830 Champion in Deployment Architecture 03-09-2015 0 2	0	2
Where to create a new app when using Search Head Clustering? Hi, In Splunk 6.2, when using SHC, where do I create a new app? It looks like new packaged apps should be done by ... by a212830 Champion in Deployment Architecture 03-09-2015 0 4	0	4
How should I configure outputs.conf on the forwarder in my indexer cluster environment with Local and Global Traffic Managers? Hello, We have 4 indexers setup as a cluster with 2 of each indexers behind 2 Local Traffic Managers (LTM). These 2 ... by sim_tcr Communicator in Deployment Architecture 03-09-2015 0 2	0	2
What software package dependencies are there for Splunk Enterprise on Debian Linux? What packages must be installed on a Debian system before I can install Splunk Enterprise? by malmoore Splunk Employee in Deployment Architecture 03-08-2015 2 2	2	2
Failed to install app Hi, After redeploying an app today I received the following errors and just cannot find the reason fro this: 11-21-... by joonradley Path Finder in Deployment Architecture 03-06-2015 4 13	4	13
Are there any special considerations we need to know when upgrading a Splunk search head cluster from 6.2 to 6.2.1? I am preparing to upgrade from 6.2 to 6.2.1 in an environment that has search head clustering enabled. When we upgra... by dflodstrom Builder in Deployment Architecture 03-06-2015 1 2	1	2
Why am I getting error "command not found" trying to start the Splunk service on Ubuntu 14? I have successfully installed splunk on ubuntu server 14. Problem is that I cannot start the service. I keep getting ... by ppbl Engager in Deployment Architecture 03-06-2015 0 7	0	7
Is it possible to deploy an external authentication script to all search heads in a search head cluster using a deployment server? Setup Splunk 6.2.1 Search head cluster with 3 search heads in a cluster Need I have an external authentication scr... by ronak Path Finder in Deployment Architecture 03-05-2015 0 1	0	1
How to Upgrade Search Head Cluster members from 6.2.1 to 6.2.2 How to Upgrade Search Head Cluster members from 6.2.1 to 6.2.2? by rbal_splunk Splunk Employee in Deployment Architecture 03-05-2015 2 2	2	2

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...

Deployment Architecture

DB Connect: Why am I getting errors trying to specify EVENT_TIMESTAMP as the rising column to pull audit data from Oracle?

In a multisite indexer cluster, how can we verify that each peer does not get more than one copy?

After upgrade to 6.2.1 from 6.1.5, why am I getting error "Could not write to auth token file" trying to run: splunk reload deploy-server?

how to manage large quantity of forwarders?

Splunk DB Connect: Why am I getting an error on my heavy forwarder trying to add a PostgreSQL database?

Search returns zero results - search.log reports "DistributedSearchResultCollectionManager - Not connecting to peer"

Moving indexes to a new Splunk server

How do you handle deployments in search head clustering if you are no longer able to use a deployment server?

Can i have 2 deployment server in 1 Linux OS computer?

What credentials should be used when initializing the deployer when setting up a search head cluster in enterprise 6.2.2?

How to change deploy-poll atomatically?

What does this event mean? " WARN DistributedBundleReplicationManager - bundle replication to 24 peer(s) took too long"

How to promote an App from Development to QA then to Production?

Indexer clustering setup with AWS EC2: How to fix error "the peer cannot connect with the master because the master_uri or secret key are wrong or invalid?"

When your universal forwarder runs as root, should all of your apps run as root?

Splunk DB Connect: If two Splunk servers create a database input from TableA, will this cause duplicates to be indexed?

Is the deployer part of the search head cluster?

Where to create a new app when using Search Head Clustering?

How should I configure outputs.conf on the forwarder in my indexer cluster environment with Local and Global Traffic Managers?

What software package dependencies are there for Splunk Enterprise on Debian Linux?

Failed to install app

Are there any special considerations we need to know when upgrading a Splunk search head cluster from 6.2 to 6.2.1?

Why am I getting error "command not found" trying to start the Splunk service on Ubuntu 14?

Is it possible to deploy an external authentication script to all search heads in a search head cluster using a deployment server?

How to Upgrade Search Head Cluster members from 6.2.1 to 6.2.2

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Cisco Enhanced Netflow Add-On Insanity

edge processor service account

Splunk Attack Range v4 Local Ubuntu

Active Directory Deployment Failure in Splunk Atta...

State of SIR in ServiceNow not capturing

Deployment Architecture

Join the Conversation