Deployment Architecture

Community Activity

Using Sudo as part of an input command im trying to run an nmap scan as an input to splunk that is running as a non-root user. Ive setup sudo to allow passw... by deadbot Engager in Deployment Architecture 09-16-2014 1 4	1	4
Cluster donot work and have much errors Hello! I have some problems with splunk-cluster. I have 1 ClusterMaster, 2 Inexer, 1 SearchHead. Replication factor =... by dbabanov Path Finder in Deployment Architecture 09-16-2014 4 2	4	2
Setting up Deployment Server to manage multiple instances on a single server Just to explain why I have to do this... Rack space is at a premium where I work so we had to consolidate our footpr... by ShaneNewman Motivator in Deployment Architecture 09-15-2014 1 4	1	4
Clustering - Master - Peer Hello Experts, I have been trying all day to get this working.Not even sure if this works with my setup. I have Splun... by Raghav2384 Motivator in Deployment Architecture 09-12-2014 1 4	1	4
Are there best practices on preserving a custom app's local configuration? Here's the scenario: Assume I have a custom app - let's call it "customApp" - which is managed by my deployment serv... by sloshburch Ultra Champion in Deployment Architecture 09-12-2014 1 5	1	5
Generate buckets between earliest and latest Hi all, I'm looking for something like seq for times in Splunk. One example: \|seq from=now to=1d span=4h would ge... by gschmitz Path Finder in Deployment Architecture 09-09-2014 1 1	1	1
How to fix Splunk search head pool "Error in dispatch process. Failed to create directory /data/var/run/dispatch/xyz"? Error in search head pooling validate-quiet: Failed to create test file: /data/etc/users/testpath: Disk quota exceede... by pdash Path Finder in Deployment Architecture 09-09-2014 0 1	0	1
How to set Splunk Mobile Access Server to automatically start at system boot on Linux? What's the best way to set the Splunk Mobile Access Server to automatically start at boot time under Linux? Manually... by petecooper Explorer in Deployment Architecture 09-08-2014 2 2	2	2
How to migrate Splunk configuration files from one Linux server to another? What is the easiest way to move all my splunk config files from one linux server to another? by hartfoml Motivator in Deployment Architecture 09-08-2014 0 3	0	3
Splunk Forwarder Add-on for Websphere Application Server: Why CreateInputs.jar seg faults while scanning directories? While attempting to run CreateInputs.jar per the instructions for the splunk_forwarder_addon_was app, it scans correc... by mbarrie_splunk Splunk Employee in Deployment Architecture 09-05-2014 1 1	1	1
Searchhead Pooling: Failed to lock sentinel.txt while saving/deleting search from GUI Red banner message in GUI (below) regarding sentinel.txt file lock is preventing updates from the GUI. Error fixing... by bwooden Splunk Employee in Deployment Architecture 09-03-2014 1 7	1	7
splunkweb does not start from base install on linux trying to install demo enterprise and splunkweb wont start ./splunk start Splunk> All batbelt. No tights. Checking... by drwndx New Member in Deployment Architecture 09-03-2014 0 3	0	3
Search Head Pooling - How to configure load balancer health monitor Hello, We are using an F5-Bigip load balancer to host splunk.company.com for a pool of search heads. Our internet s... by zindain24 Path Finder in Deployment Architecture 09-02-2014 1 3	1	3
Scripted Input - Script calling another script I have a scripted input, top20.sh, calling another script - top.sh. inputs.conf [script://./bin/top20.sh] interval ... by jamesvz84 Communicator in Deployment Architecture 09-02-2014 0 2	0	2
Errors running enable boot-start with specific user on a Search Head with pooling config Hi all, I´m running a Lab with two Search Heads on a pool using a third server as NFS mount point. Everything is wo... by theunf Communicator in Deployment Architecture 09-02-2014 0 1	0	1
Forwarding from one indexer to another I have one search-head and two indexers (let's call indexer1 and indexer2). Clients are sending all syslog to indexer... by bckq Path Finder in Deployment Architecture 09-02-2014 0 4	0	4
Is there a way to control the size of Frozen Buckets? Hi, I need to retain about 6 months of events (3 months of searchable data + 3 months stored on frozen data). The f... by marciodcr Engager in Deployment Architecture 08-29-2014 0 2	0	2
Specifying class while reloading deploy-server not working in Splunk 6 /opt/splunk/bin $ /opt/splunk/bin/splunk reload deploy-server -class MyClass An error occurred: Argument "class" is... by caseypike Path Finder in Deployment Architecture 08-29-2014 9 21	9	21
PCI requirement 10.5.5 Hello, I am trying to cover PCI requirement 10.5.5: Use file integrity monitoring and change detection software on l... by trharter1027 Engager in Deployment Architecture 08-28-2014 4 4	4	4
Moving a single index (or multiple) away from the defaultdb Currently in Splunk we have it set up in indexes.conf to explicitly request that "cartlog" (a specific index) go to i... by beepboop12 Explorer in Deployment Architecture 08-27-2014 0 4	0	4
Syslog disk full Alert after changing hostname of the server Dear Helpers, I'm keep getting syslog disk full alert, after changing the hostname of the server, where I installed ... by thesriidhar Explorer in Deployment Architecture 08-27-2014 0 7	0	7
Splunk 6 Forwarder Management Question Scenario Upgraded from Splunk 4 to Splunk 6. Using deployment server to distribute apps There are a large number o... by dshakespeare_sp Splunk Employee in Deployment Architecture 08-26-2014 2 4	2	4
Is there a REST API that can tell if a search head running on search head pooling or local? Is there a REST API that can tell if a search head running on search head pooling or local? It will be helpful for o... by philip_wong Communicator in Deployment Architecture 08-26-2014 1 2	1	2
Integrate Splunk with RSA Customer already deploy RSA by sending syslog, snmp trap, WMI, and proprietary RSA agent to sent logs to RSA logger. ... by santisookgable New Member in Deployment Architecture 08-24-2014 0 7	0	7
Can I find where an event is located in splunk ? I am trying to localize where my events are located. - in which indexer - in which index - in which bucket Can I ... by mataharry Communicator in Deployment Architecture 08-19-2014 2 1	2	1