Deployment Architecture

Community Activity

centralized syslog server with universal forwarder We currently have a centralized syslog server in place and are looking to test Splunk in our environment. At first, ... by Wahahahahaha Engager in Deployment Architecture 06-08-2011 1 5	1	5
DeploymentClient not grabbing Deployment server apps. Alright, I've been researching this for the last few hours and I'm at loss. Here's what I'm having issues with. I ha... by jpfry Explorer in Deployment Architecture 06-01-2011 2 5	2	5
Splunk configuration changes - SIGHUP or restart? Sometimes I make changes to my Splunk server's configuration, but I do not want to restart Splunk. Which configura... by araitz Splunk Employee in Deployment Architecture 06-01-2011 12 3	12	3
timeinvertedIndex - Splunk-optimize failed to start for index ../fishbucket/db/db-hot Hello, i have installed Splunk 4.1.1. When i look at the -> Status -> Index Health page, i see there is this follow... by tpaulsen Contributor in Deployment Architecture 05-26-2011 1 4	1	4
Help with Deployment Server and Client? Step-bystep available? I've read through the docs and come up with a simple test config: st1: Deployment Server$SPLUNK_HOME/etc/deployment... by twinspop Influencer in Deployment Architecture 05-24-2011 1 13	1	13
change indexer - point forwarder to another index server. Hi, I have one index server "A" and another one "B". For a while I had few forwarders to send data to "A" (each forwa... by nurtdi Path Finder in Deployment Architecture 05-23-2011 1 5	1	5
What actions require restarts? Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk? I w... by pdevlin Explorer in Deployment Architecture 05-21-2011 1 4	1	4
Installation of Splunk again and again. Dear All, I am new to Splunk, So while doing changes in input.conf or props.conf etc. the changes are not taking pla... by msona Explorer in Deployment Architecture 05-20-2011 0 9	0	9
auto_high_volume vs hardset to 10GB ? Is setting auto_high_volume the same as setting bucket size to 10GB? Or, does auto_high_volume give a variable bucke... by the_wolverine Champion in Deployment Architecture 05-12-2011 2 1	2	1
scripted inputs execution interval I have deployed the unix app on universal forwarder.How to change default execution interval for the scripted inputs? by bwenge Explorer in Deployment Architecture 05-12-2011 2 3	2	3
Adding zero values to "Average per Weekday" calculation Hi! I'm a Splunk newbie, so I spent some time with the documentation and this forum, learning how to use this powerf... by Andreyd New Member in Deployment Architecture 05-12-2011 0 3	0	3
What initiates the data rotation between buckets? Hi all, which of the following initiates data rotation between buckets. Is it the time from which the event is inde... by jamesaarondevli Path Finder in Deployment Architecture 05-12-2011 0 1	0	1
Search head pooling: can it be used to share authentication information? Can I use an app in etc/apps to contain authentication data for use on all my search heads - via search head pooling? by Jason Motivator in Deployment Architecture 05-11-2011 3 2	3	2
Why am I getting license violations on my search-head? On my 4.0.9 instance, I keep getting notifications that I have exceeded the license volume. The only indexing I'm do... by mctester Communicator in Deployment Architecture 05-11-2011 0 4	0	4
How do I set a default search index per app? We have reached a conclusion that a new app should have all of its data in a unique index. How do I set (or overrid... by Claw Splunk Employee in Deployment Architecture 05-10-2011 3 3	3	3
enabling nix with universal forwarder stops forwarding logs from /etc/system/local/inputs.conf I'm trying to get the nix app going using the universal forwarder. I can forward logs fine from /etc/system/local/i... by agent462 New Member in Deployment Architecture 05-04-2011 0 2	0	2
Is it normal to see splunk-optimize running on a splunk forwarder instance? I can see why it runs on my forwarders that are also indexing data, but why is it running on my LightWeightForwarder ... by Mick Splunk Employee in Deployment Architecture 05-04-2011 2 3	2	3
How does Field discovery work on Search heads? I have a Splunk Search head that gets data from a Splunk Server that is indexing IIS logs. When I Query on the Index... by richnavis Contributor in Deployment Architecture 05-02-2011 0 1	0	1
how to manage the size of my indexes to fit in my volumes. On splunk 4.1.5 how to tune my data retention and rotation between the buckets ? I have limited disk space and I want... by mataharry Communicator in Deployment Architecture 04-29-2011 2 3	2	3
install splunk for linux apps using CLI Hi, How to install splunk for linux app using Command Line,not using Web interface.Can you also recommend me documen... by bwenge Explorer in Deployment Architecture 04-28-2011 0 7	0	7
Block Signing and distributed search Hello, I can configure IT data signing if I turn on the "distributed search "? In the manual at the following link: ... by DanieleP Engager in Deployment Architecture 04-27-2011 0 1	0	1
upgraded to 4.2, now deployment clients fail to connect to deployment-server on tuesday i upgraded my deployment server, my searchhead and my 3 indexers from 4.1.6 to 4.2. I have not updated my ... by tpsplunk Communicator in Deployment Architecture 04-26-2011 3 4	3	4
Searching for failed file accesses from linux audit data In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main... by chadroberts Path Finder in Deployment Architecture 04-21-2011 0 3	0	3
Moving splunk to a new server I am in the process to migrate our Splunk installation to a new server. I found how to move the Splunk index... a bi... by bfay Explorer in Deployment Architecture 04-19-2011 0 2	0	2
Disk - > Disk space used by host Hi this may sound like a simple question ... we are on splunk 4.2 We have a number of linux servers that we are t... by GOGRADY Engager in Deployment Architecture 04-15-2011 2 1	2	1