Deployment Architecture

Community Activity

creation of new index through ds not working i created a new index by creating a new TA app. i added the indexes.conf to the default folder . when i pushed the co... by spyme72 Path Finder in Deployment Architecture 11-01-2013 0 1	0	1
Search Head and 2 peers, how setup hey guys, i need some help i have 3 machines, and 2 of than is receiving data, and i want to user the third machine ... by felipesewaybric Contributor in Deployment Architecture 11-01-2013 0 1	0	1
Any issues with environment where your 5.0 SH searches both 5.x and 4.x indexers? I'd like to set up a new 5.0.3 cluster but I'd like to ALSO point the SH to my old 4.3 indexers so that I do not have... by the_wolverine Champion in Deployment Architecture 11-01-2013 0 1	0	1
High availability: Splunk cluster across two datacenters - redux What is the best practice for distributed data across 2 or more data-centers? The objective is geographic redundancy... by BenAveling Path Finder in Deployment Architecture 11-01-2013 1 1	1	1
Splunk Java SDK, load balancing on indexers when sending events from SDK I am creating a java program using SPlunk SDK which takes a string data from a application source and pass it to a sp... by somesoni2 Revered Legend in Deployment Architecture 10-31-2013 0 2	0	2
Deleting a bucket Suppose I want to delete a bucket from an indexer for some reason. Can I: stop splunkdelete the offending bucketstar... by bobwalden Explorer in Deployment Architecture 10-31-2013 1 1	1	1
What is the deployment polling data meaning for ? Hi splunkers, Yesterday, I was monitoring the splunk_access.log and found the log messages that deployment clients ... by sunrise Contributor in Deployment Architecture 10-30-2013 0 3	0	3
Access Control Within DBConnect (DBX) Does anyone know how to accomplish this? I have tried utilizing the "Restrict search terms" but it is not working. ... by jodros Builder in Deployment Architecture 10-30-2013 0 4	0	4
Can the /opt/splunk/var directory be symlinked to /var? I'm attempting to replace the /opt/splunk/var folder with the /var folder via symlink to keep relatively small amount... by nbeyer_cerner New Member in Deployment Architecture 10-30-2013 0 1	0	1
TIME_FORMAT on props.conf broke line breaking. Hello, I have timestamps in the following format. 1383058343.661030 I added the following to my props.conf. TIME_... by agodoy Communicator in Deployment Architecture 10-29-2013 0 3	0	3
Sanity Check After Restarting Splunk And Having Trouble I have Splunk 4.32 installed on Linux. Today I stopped Splunk, used the 'clean eventdata index_name' to clear up some... by jpass Contributor in Deployment Architecture 10-28-2013 0 3	0	3
Average latency per hour I am attempting to find out the average latency of my requests by ip, per hour, over a 24 hour period. I'm sure i'm m... by tmarlette Motivator in Deployment Architecture 10-25-2013 0 1	0	1
Max Bucket Size warning On the indexer in Splunk 6 getting this error message 10-25-2013 17:00:11.024 -0400 WARN IndexConfig - Max bucket s... by peter_gianusso Communicator in Deployment Architecture 10-25-2013 2 2	2	2
separating search heads Hi, I have a customer who wants to utilize their own search-head to read some Splunk data that I administer. In the... by a212830 Champion in Deployment Architecture 10-25-2013 1 2	1	2
What's the least installed to allow remote execution of CLI? Hello, all! As a "TL;DR" to get right to the point, my main question is this: What is the minimum needed to be inst... by jchensor Communicator in Deployment Architecture 10-25-2013 1 2	1	2
Does splunk expand the asterisk wildcard in serverclass.conf? When you define a whitelist or blacklist, suppose you have a set of servers which are differentiated by a character a... by msarro Builder in Deployment Architecture 10-23-2013 0 3	0	3
current_only=1 for /var/log/messages I noticed we can enabled the 'current_only' feature for Windows event logs, Does the UF for *NIX support the same typ... by bigtyma Communicator in Deployment Architecture 10-21-2013 0 3	0	3
UniversalForwarder / Splunk_TA_Windows re-load output.conf ? I had a problem where my output.conf file was incorrect (Linux formatting, instead ^M newline formatted for Windows).... by semenko New Member in Deployment Architecture 10-21-2013 0 1	0	1
Splunk_TA_windows / Universal Forwarder phoning home, not sending data? I'm new to Splunk, and trying it out in a small environment of Windows 8 machines. I have a Splunk frontend (collect... by semenko New Member in Deployment Architecture 10-21-2013 0 4	0	4
DB Connect on Splunk Forwarder? Is it possible to install splunk db connect on a universal forwarder? I would like to fetch the data and just forwa... by gdavid Path Finder in Deployment Architecture 10-18-2013 0 1	0	1
Connect to another server via ODBC We are attempting to integrate a QuickFill (QF) database with Splunk for reporting purposes; by default QF prefers OD... by redc Builder in Deployment Architecture 10-18-2013 1 7	1	7
linux_secure by default I have results from a search that splunk has tagged as linux_secure (sourcetype) appears by default. Is there a way ... by amortiz Explorer in Deployment Architecture 10-18-2013 0 4	0	4
Variable for Splunk install directory in deployed scripts I need to run a vbs script on some of my Windows Forwarders. To do so, I have deployed a batch script that calls the ... by rtadams89 Contributor in Deployment Architecture 10-17-2013 0 5	0	5
Splunk Replication a Good BCP Alternative? We have been working with our architects to determine the most appropriate solution for BCP. Does Splunk replicate no... by andrewkenth Communicator in Deployment Architecture 10-17-2013 1 1	1	1
_audit index not getting replicated in clustering _audit index is not getting replicated in clustering. by ssankeneni Communicator in Deployment Architecture 10-16-2013 0 1	0	1