Deployment Architecture

Community Activity

splunk gets confused after log is rotated by my app server restart My app server gets restarted once a day. Sometimes, Splunk will treat individual lines as unique log entry. So what s... by scott74nyc New Member in Deployment Architecture 06-24-2011 0 1	0	1
Index assignment for related sub-networks An enterprise network has many sub-networks each with UniversalForwarders forwarding to a central pool of Indexers. T... by sdwilkerson Contributor in Deployment Architecture 06-23-2011 0 2	0	2
Does maxTotalDataSizeMB include thaweddb? maxTotalDataSizeMB parameter controls the index size as a whole so this includes hotdb, warmdb and colddb, but how ab... by elusive Splunk Employee in Deployment Architecture 06-20-2011 2 1	2	1
multiple management ports Hi , the case is about splunk deployment issue there is a deployment server and 20 deployment clients , we had finis... by dmlee Communicator in Deployment Architecture 06-15-2011 0 1	0	1
How to upgrade splunk RPM and keep splunk user file permissions? I am using the RPM package for splunk. I also utilize the "run splunk as splunk user" option. But there is a proble... by gfriedmann Communicator in Deployment Architecture 06-15-2011 0 1	0	1
error message "replication was unsuccessful" During one of my searches, I got this following error message "unable to distribute to peer named splunk_index01 at u... by dmlee Communicator in Deployment Architecture 06-14-2011 3 12	3	12
Process HP-UX Audit logs Hi, We are trying to get HP-UX audit logs processed by Splunk. We get the logs in binary format, and run then throu... by michaelgoodwin New Member in Deployment Architecture 06-10-2011 0 1	0	1
Deployment monitor not showing accurate information on forwarders I've just upgrade a splunk server from 4.1.7 to 4.2.1. After the upgrade,I enabled the deployment monitor and notice... by remy06 Contributor in Deployment Architecture 06-10-2011 0 1	0	1
different deployment dir for same app I have several hosts I want to deploy the same app to. I would like to use a different local/inputs.conf for differe... by dinisco Explorer in Deployment Architecture 06-09-2011 0 1	0	1
Backing up hot buckets on NetApp According to the documentation: "To back up hot buckets as well, you need to take a snapshot of the files, using a to... by Branden Builder in Deployment Architecture 06-08-2011 1 1	1	1
centralized syslog server with universal forwarder We currently have a centralized syslog server in place and are looking to test Splunk in our environment. At first, ... by Wahahahahaha Engager in Deployment Architecture 06-08-2011 1 5	1	5
DeploymentClient not grabbing Deployment server apps. Alright, I've been researching this for the last few hours and I'm at loss. Here's what I'm having issues with. I ha... by jpfry Explorer in Deployment Architecture 06-01-2011 2 5	2	5
Splunk configuration changes - SIGHUP or restart? Sometimes I make changes to my Splunk server's configuration, but I do not want to restart Splunk. Which configura... by araitz Splunk Employee in Deployment Architecture 06-01-2011 12 3	12	3
timeinvertedIndex - Splunk-optimize failed to start for index ../fishbucket/db/db-hot Hello, i have installed Splunk 4.1.1. When i look at the -> Status -> Index Health page, i see there is this follow... by tpaulsen Contributor in Deployment Architecture 05-26-2011 1 4	1	4
Help with Deployment Server and Client? Step-bystep available? I've read through the docs and come up with a simple test config: st1: Deployment Server$SPLUNK_HOME/etc/deployment... by twinspop Influencer in Deployment Architecture 05-24-2011 1 13	1	13
change indexer - point forwarder to another index server. Hi, I have one index server "A" and another one "B". For a while I had few forwarders to send data to "A" (each forwa... by nurtdi Path Finder in Deployment Architecture 05-23-2011 1 5	1	5
What actions require restarts? Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk? I w... by pdevlin Explorer in Deployment Architecture 05-21-2011 1 4	1	4
Installation of Splunk again and again. Dear All, I am new to Splunk, So while doing changes in input.conf or props.conf etc. the changes are not taking pla... by msona Explorer in Deployment Architecture 05-20-2011 0 9	0	9
auto_high_volume vs hardset to 10GB ? Is setting auto_high_volume the same as setting bucket size to 10GB? Or, does auto_high_volume give a variable bucke... by the_wolverine Champion in Deployment Architecture 05-12-2011 2 1	2	1
scripted inputs execution interval I have deployed the unix app on universal forwarder.How to change default execution interval for the scripted inputs? by bwenge Explorer in Deployment Architecture 05-12-2011 2 3	2	3
Adding zero values to "Average per Weekday" calculation Hi! I'm a Splunk newbie, so I spent some time with the documentation and this forum, learning how to use this powerf... by Andreyd New Member in Deployment Architecture 05-12-2011 0 3	0	3
What initiates the data rotation between buckets? Hi all, which of the following initiates data rotation between buckets. Is it the time from which the event is inde... by jamesaarondevli Path Finder in Deployment Architecture 05-12-2011 0 1	0	1
Search head pooling: can it be used to share authentication information? Can I use an app in etc/apps to contain authentication data for use on all my search heads - via search head pooling? by Jason Motivator in Deployment Architecture 05-11-2011 3 2	3	2
Why am I getting license violations on my search-head? On my 4.0.9 instance, I keep getting notifications that I have exceeded the license volume. The only indexing I'm do... by mctester Communicator in Deployment Architecture 05-11-2011 0 4	0	4
How do I set a default search index per app? We have reached a conclusion that a new app should have all of its data in a unique index. How do I set (or overrid... by Claw Splunk Employee in Deployment Architecture 05-10-2011 3 3	3	3