Deployment Architecture

Community Activity

How to route to separate indexes based on host:: when forwarding to a indexer from SplunkLightForwarders I use several SplunkLightFirwarders on Suslog-ng servers to have a "buffer" to relatively large amounts of syslog tha... by ostmovid New Member in Deployment Architecture 05-18-2010 0 9	0	9
Managing Splunk LF with Deployment Server Hey guys, I managed to setup deployment server / client test model with our 2 central indexers and a test sample of... by balbano Contributor in Deployment Architecture 05-17-2010 0 1	0	1
What are the id_XX buckets that show up under "index activity" What are the id_XX buckets that show up under "index activity", They also show up in the bucket directories. What do ... by Chris_R_ Splunk Employee in Deployment Architecture 05-13-2010 0 4	0	4
Can I distribute my search across one 32-bit and one 64-bit Splunk instance simultaneously? If I have a Splunk indexer running on a 32-bit OS and another Splunk indexer running on a 64-bit OS, can I setup Splu... by maverick Splunk Employee in Deployment Architecture 05-13-2010 1 2	1	2
event filtering and deployment server If I have a UDP input defined in /etc/system/local/inputs.conf and I create event filters using a transforms.conf and... by jambajuice Communicator in Deployment Architecture 05-12-2010 1 1	1	1
Minimizing logging on Splunk Light Forwarder... Hey Guys, Just noticed that logging on one of my light forwarders is taking up a lot of space: myhost[05:15 PM]roo... by balbano Contributor in Deployment Architecture 05-11-2010 1 2	1	2
How do concurrent searches and other user quotas work in a distributed environment? How do I know if users hit one? I'm familiar with some of the system-wide limits and per-user quotas that prevent a Splunk instance from getting over... by Dan Splunk Employee in Deployment Architecture 05-10-2010 3 1	3	1
Hardware vs. software RAID For indexer requirements, the following is listed as the recommendation configuration in the Planning Your Splunk Dep... by hulahoop Splunk Employee in Deployment Architecture 05-10-2010 1 3	1	3
Disable lightweight forwarding in 4.1 from command line I stupidly enabled Lightweight forwarding from the web interface and now I can't get the web interference to load. H... by tepperso Engager in Deployment Architecture 05-07-2010 0 2	0	2
Are there any reasons to setup both monitor and fschange on the same path? Are there any reason to setup both [monitor://] and a [fschange:] inputs for a single path? Are there any problems w... by Lowell Super Champion in Deployment Architecture 05-05-2010 1 3	1	3
What are the .sentinel files in $SPLUNK_DB for? I was moving some buckets around to make some space on my main storage volume. I know the db_* directories are compl... by mctester Communicator in Deployment Architecture 05-05-2010 3 5	3	5
How do I quickly make some space on the $SPLUNK_DB partition? The splunk cold storage file system is 100% full. I'm relatively new to splunk & not sure the proper way to purge. by mctester Communicator in Deployment Architecture 05-04-2010 0 3	0	3
Still getting license violations on my search head, even with 4.0.10 I had the Unix app running for a while on this instance and that was indexing a lot of data so I disabled the 'os' in... by mctester Communicator in Deployment Architecture 04-30-2010 1 1	1	1
Deploy an app using deployment server and make searches globally available by default? I have an "app" that I deploy with my 4.x deployment server. It sends savedsearches.conf, tags.conf, props.conf, eve... by dave_duvall Explorer in Deployment Architecture 04-30-2010 0 2	0	2
Whats the best way to monitor deployment activity? Anyone know the best way to monitor deployment activity of a splunk server? I've found DeploymentMetrics coming from... by Lowell Super Champion in Deployment Architecture 04-30-2010 0 1	0	1
Will a 3.x deployment server client "ignore" the 4.x deployment server I'm in the process of upgrading my deployment server to 4.x. I don't push configuration change that often and I hav... by dave_duvall Explorer in Deployment Architecture 04-29-2010 0 2	0	2
Can Splunk Deployment Server push out new admin passwords? I need to push out a new admin password to all of my remote Splunk instances/forwarders. Can I use Splunk Deployment... by maverick Splunk Employee in Deployment Architecture 04-26-2010 1 6	1	6
Is there a CLI command to set serverClasses in deployment.conf Is there a CLI command that will set serverClasses in the deployment.conf file. Using Splunk forwarder version 3.4.1... by kbecker Communicator in Deployment Architecture 04-26-2010 1 1	1	1
Getting error message - "There is no query runner registered" Just completed an upgrade and we are getting the error message - "There is no query runner registered" "Internal Serv... by rsimmons Splunk Employee in Deployment Architecture 04-17-2010 2 4	2	4
How long should bundle tar files persist in the search head? Can the space used be limited? The disk space use on our search head is going up significantly. I would seem that *.bundle files in $SPLUNK_HOME/var... by mzorzi Splunk Employee in Deployment Architecture 04-16-2010 3 4	3	4
Do I need to configure distributed search on all the search peers? Do I need to configure distributed search on all the search peers? by lguinn2 Legend in Deployment Architecture 04-14-2010 1 2	1	2
How to configure auto loadbalancing on multiple indexes? How should I allocate space for indexes among indexing nodes? For example, lets say I have 2 groups of servers that ... by Jeremiah Motivator in Deployment Architecture 04-14-2010 1 1	1	1
Is there a best way to rename a Splunk indexer server? I've been asked to look into renaming my Splunk indexer server (don't ask why). Is there a "best" or safe method for... by cdavidy Explorer in Deployment Architecture 04-14-2010 1 2	1	2
what changes are there to scripted auth from 3.4.x to 4.1? Are there are any critical changes to be aware of when migrating a complex distributed scripted auth setup on 3.4.x t... by zscgeek Path Finder in Deployment Architecture 04-06-2010 1 3	1	3
Errors Uninstalling Apps with Deployment Server Preventing Splunkd restarts When uninstalling an app, the following errors are preventing splunkd for restarting: 03-30-2010 22:28:12.157 WARN ... by oreoshake Communicator in Deployment Architecture 04-04-2010 1 2	1	2