Deployment Architecture

Community Activity

HEC HWF behind AWS Loadbalancer. ELB or ALB? Hello all. I am wondering what’s the best choice for putting the HTTP event collector behind an AWS load balancer. It... by brent_weaver Builder in Deployment Architecture 09-15-2022 0 2	0	2
Why isn't my SmartStore OpenStack Swift configuration working? Hi Team, I'm having some issues using OpenStack Swift as s3 for SmartStore. I have the following configuration in my ... by medinjor Loves-to-Learn Lots in Deployment Architecture 09-15-2022 0 1	0	1
Is it possible to have a standalone index on one site of a multisite cluster? I'm looking to setup a multisite indexer cluster. And due to GDPR, I'd like to have a non-replicated index on one of ... by nbowman Path Finder in Deployment Architecture 09-14-2022 0 2	0	2
Search Head Cluster push bundle is too slow after Splunk upgrade Search Head Cluster push bundle is too slow after splunk upgradeBundle Push was so quick in my Splunk version 7.2.9, ... by AnilPujar Path Finder in Deployment Architecture 09-13-2022 0 0	0	0
How to troubleshoot error "idx=... Throttling indexer, too many tsidx files in bucket=..." on my distributed management console? Hi, I noticed this popping up on my Distributed Management Console the other day: throttled - idx=ngccc_app_logs Th... by a212830 Champion in Deployment Architecture 09-12-2022 0 4	0	4
Load on indexers high, am I able to add more indexers to help? hi all, I have 3 indexers with 26 CPU/ indexer they are crying out loud due to load. I may not be able to increase C... by KulvinderSingh Path Finder in Deployment Architecture 09-12-2022 0 2	0	2
How to know what buckets are frozen due to size? I got an alert that some of the indexes buckets have been frozen due to size. How to get the bucket details. I mean t... by vrmandadi Builder in Deployment Architecture 09-12-2022 0 3	0	3
What are the recommended steps to unsubscribe the forwarder at the management & deploymentserver? Hi community,a few month ago I have overtaken our Splunk cluster from a colleague who quit his job.Now I have the sit... by armin1967 Explorer in Deployment Architecture 09-12-2022 0 4	0	4
How to move frozen buckets back to warm? We have changed how we do things, intending to move to smartcache shortly. We have a lot of frozen data we would li... by capqwerty Loves-to-Learn in Deployment Architecture 09-11-2022 0 1	0	1
How do I integrate IBM Guardium with Splunk? From an IP send logs to syslog server via tcp/udp 1503 and Universal forwarder install on this serverNeed to send lo... by engrimranzakir Explorer in Deployment Architecture 09-11-2022 0 0	0	0
Why is my UF not connecting to HF and DS? My UF configured with deployment server 8089 and with HF 9997 both are not connecting troubleshoot steps performed: ... by BalaMandalapu24 Loves-to-Learn Everything in Deployment Architecture 09-08-2022 0 7	0	7
If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets? Hello guys, if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary an... by splunkreal Influencer in Deployment Architecture 09-08-2022 0 7	0	7
Help with error reload class Hello colleaguesWhen running the command (/opt/splunk/bin/splunk reload deploy-server -class Class_Name -debug) There... by gitingua Communicator in Deployment Architecture 09-08-2022 0 0	0	0
Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations? Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/conf... by JoeSco27 Communicator in Deployment Architecture 09-08-2022 6 9	6	9
Unable to delete search results We are using 8.2.3 with SHC and multisite indexer clustering.We have some mismatch on key business data and we need t... by sylim_splunk Splunk Employee in Deployment Architecture 09-06-2022 1 1	1	1
How the red flag, "the percentage of small buckets", works? Hello everyone I have been trying to understand how this alert works because for my point of view doesn't make sense.... by glpadilla_sol Path Finder in Deployment Architecture 09-06-2022 0 2	0	2
Help with Windows dormant enable search Hi All, I want to create a use case where the account is inactive for 60 days and it got enable after 60 days.. I t... by debjit_k Path Finder in Deployment Architecture 09-05-2022 0 0	0	0
How to upgrade a single Search Head to a Search Head Cluster? Hello, please I would like to know if the best approach to "move" a single Search Head to a Search Head Cluster is t... by lucacaldiero Path Finder in Deployment Architecture 09-05-2022 0 3	0	3
Does it make sense to have a DR indexer be part of cluster? I inherited a splunk mesh of search-heads, deployment server, index cluster, etc. I am trying to figure out all this ... by HathMH Path Finder in Deployment Architecture 09-04-2022 0 4	0	4
If I have a Splunk DS version 9.0.1, what is the oldest version of Splunk UF that I can control, please? Dear All,I have about 100 Splunk UFs at 7.0.1, 7.3.5, 8.1.5, 8.2.5 and 9.0.0.1 and they are NOT being managed by a De... by BlueSocket Contributor in Deployment Architecture 09-02-2022 0 3	0	3
Can we configure input.conf define port with multiple sourcetype? Can we configure input.conf define port with multiple sourcetype? For ex. [tcp://6134]index = topsourcetype = mac_log... by ManojNegi New Member in Deployment Architecture 09-02-2022 0 1	0	1
The search job terminated unexpectedly in dashboard I am getting "The search job terminated unexpectedly" in the dashboard. In search, the index is working fine. And th... by rajesh01 Loves-to-Learn in Deployment Architecture 09-02-2022 0 3	0	3
Why is the latest version of the Forwarder Compatibility document still v 8.2.5, when we are on 9.0.1? Dear All/Splunk Documentation Team,I am trying to get to read the Compatibility between forwarders and Splunk Enterpr... by BlueSocket Contributor in Deployment Architecture 09-01-2022 0 1	0	1
How do I run diagnostic tools without root access? Hello, I have splunk starting up with systemd, and running as user splunk. I went to run the performance tasks on... by jason0 Path Finder in Deployment Architecture 08-31-2022 1 0	1	0
Add non-clustered indexer and standalone search head to existing cluster Hello,we had standalone search head and indexer in a pre-production environment then I created new clustered environm... by splunkreal Influencer in Deployment Architecture 08-31-2022 0 5	0	5