Deployment Architecture

Community Activity

DNS Name and not IP for TCPOUT in outputs.conf Can I use an DNS name and not the ip address of the server in the TCPOUT stanza in outputs.conf? Exaple: [tcpout] d... by treinke Builder in Deployment Architecture 10-04-2010 0 1	0	1
Extract timestamp from CSV in UNIX time Greetings! I'm still super new to splunk, so please be gentle :) I am trying to extract a timestamp from CSV records.... by msarro Builder in Deployment Architecture 10-01-2010 1 1	1	1
Search Head Summary Page Missing Data We recently deployed a dedicated search head (as it is not indexing any data) in our environment with a single index ... by Blu3fish Path Finder in Deployment Architecture 09-30-2010 0 7	0	7
"not a splunk server" status for (previously) functioning splunk server 2 Splunk 4.1.3 indexers, 1 4.1.3 search head. The search head is connected to the 2 indexers over a T1 that can get b... by twinspop Influencer in Deployment Architecture 09-29-2010 1 4	1	4
How to enable UDP input for splunk LWF? Apparently enabling LWF turns off udp input. What are the step steps to enable it? by Alan_Bradley Path Finder in Deployment Architecture 09-28-2010 0 4	0	4
commandline method to test Splunk over UDP? There must be an easy way to fire a single message over UDP to a splunk forwarder/server. "logger" nearly does it. I ... by tedder Communicator in Deployment Architecture 09-28-2010 2 2	2	2
metrics.log filling up filesystem on LWF We have a LWF on Linux that is forwarding to our indexer. We're a little tight on space, but in my experience the LWF... by Branden Builder in Deployment Architecture 09-22-2010 1 3	1	3
Is it possible to migrate data from 3.3.4 Sparc to 4.1.4 Linux? I would like to migrate my indexed data from Splunk 3.3.4 on a Sparc Solaris 10 platform to Splunk 4.1.4 on a Linux (... by mctester Communicator in Deployment Architecture 09-21-2010 0 2	0	2
Splunk on AWS EC2 Hi, We're working with Splunk on Amazon's EC2 service (Ubuntu). At the moment we're working off a standard instance... by garfieldconnoll Explorer in Deployment Architecture 09-20-2010 1 3	1	3
expected behavior of lsof for nix I recently made a stab at porting the lsof nix app to AIX. I realize this is an unsupported configuration, but we AI... by Branden Builder in Deployment Architecture 09-14-2010 0 2	0	2
Splunk Search Head and Fields I have a configuration on a splunk indexer including search time fields extractions (using a DELIMS/FIELDS config in ... by sumnerm Path Finder in Deployment Architecture 09-14-2010 2 5	2	5
concurrent search limit in distributed search There is a default limit for concurrent search which comes from max_searches_per_cpu x cpu_cores + base_max_searches.... by haobin Explorer in Deployment Architecture 09-13-2010 3 1	3	1
Setting up forwarder from CLI problem Hi, I'm experiencing problems when configuring SSL forwarder from CLI. My questions are: Is it enough to move output... by gljiva Path Finder in Deployment Architecture 09-10-2010 0 2	0	2
Apps packaged in splunk rpm have invalid permissions? We have installed splunk instances on our servers to be used as forwarders. We use the deployment client/server to p... by christopherutz Path Finder in Deployment Architecture 09-09-2010 1 2	1	2
HALP! My *nix deployment server is propagating corrupted configuration files to my Windows clients! I've noticed that the configuration files propagated by my Linux deployment server to my Windows deployment clients s... by hexx Splunk Employee in Deployment Architecture 09-02-2010 2 3	2	3
How to manage deployment clients? In Splunk documentation, the communication model between deployment server and clients is described as The deploymen... by hulahoop Splunk Employee in Deployment Architecture 08-30-2010 6 2	6	2
What's this duplicate bucket in my index? I've got bucket in my defaultdb/db named things like db_1282889175_1282864311_6-duplicate-0/ What are they? Should I... by jrodman Splunk Employee in Deployment Architecture 08-27-2010 1 1	1	1
I got a "Streamed search execute failed because" warning message in Splunk? What does this mean? During one of my searches, I got this following error message "Streamed search execute failed because: St9bad_alloc".... by rsimmons Splunk Employee in Deployment Architecture 08-26-2010 1 2	1	2
Does the ip_group_city.csv need to be pushed to Indexers also? I haven't gotten it to work. It looks like it wants the ip_group_city.csv on all the indexers. I keep getting this w... by JohnB Explorer in Deployment Architecture 08-26-2010 1 1	1	1
Deployment app vanished I am having an issue with the deployment server and I'm not sure what to make of this. I recently learned about the ... by Branden Builder in Deployment Architecture 08-23-2010 0 5	0	5
How do I configure default apps with deployment server? I've got my custom apps (mostly custom inputs.conf files) working, and now I'm looking into configure some of the def... by Joffer Path Finder in Deployment Architecture 08-23-2010 0 8	0	8
Turning on SplunkLightForwarder via deployment Server? I'm setting up our deployment server configuration. I have the following set up in my serverclass.conf: [serverClas... by Brian_Osburn Builder in Deployment Architecture 08-20-2010 1 6	1	6
Where are the limitations of IT block data signing? Hi all, I'm currently evaluating the IT block data signing feature of splunk and have some questions about it: How ... by Simon Contributor in Deployment Architecture 08-19-2010 2 2	2	2
Can I force Splunk to drp core in a specific location? Is there a way to specify an alternate location for a Splunk forwarder to do its Splunk crash dumps? by matt Splunk Employee in Deployment Architecture 08-18-2010 0 5	0	5
I don´t understand how the deployment server works Hello, i seem to have a basic missunderstanding how the Splunk 4.1.3 Deployment Server works. I want to deploy a simp... by tpaulsen Contributor in Deployment Architecture 08-17-2010 2 13	2	13