Deployment Architecture

Community Activity

Load on indexers high, am I able to add more indexers to help? hi all, I have 3 indexers with 26 CPU/ indexer they are crying out loud due to load. I may not be able to increase C... by KulvinderSingh Path Finder in Deployment Architecture 09-12-2022 0 2	0	2
How to know what buckets are frozen due to size? I got an alert that some of the indexes buckets have been frozen due to size. How to get the bucket details. I mean t... by vrmandadi Builder in Deployment Architecture 09-12-2022 0 3	0	3
What are the recommended steps to unsubscribe the forwarder at the management & deploymentserver? Hi community,a few month ago I have overtaken our Splunk cluster from a colleague who quit his job.Now I have the sit... by armin1967 Explorer in Deployment Architecture 09-12-2022 0 4	0	4
How to move frozen buckets back to warm? We have changed how we do things, intending to move to smartcache shortly. We have a lot of frozen data we would li... by capqwerty Loves-to-Learn in Deployment Architecture 09-11-2022 0 1	0	1
How do I integrate IBM Guardium with Splunk? From an IP send logs to syslog server via tcp/udp 1503 and Universal forwarder install on this serverNeed to send lo... by engrimranzakir Explorer in Deployment Architecture 09-11-2022 0 0	0	0
Why is my UF not connecting to HF and DS? My UF configured with deployment server 8089 and with HF 9997 both are not connecting troubleshoot steps performed: ... by BalaMandalapu24 Loves-to-Learn Everything in Deployment Architecture 09-08-2022 0 7	0	7
If we add additional indexer to existing clustered indexers, how will we spread primary and replication buckets? Hello guys, if we add new indexer to existing cluster of 3 indexers with RF=3 and SF=3, how will be spread primary an... by splunkreal Influencer in Deployment Architecture 09-08-2022 0 7	0	7
Help with error reload class Hello colleaguesWhen running the command (/opt/splunk/bin/splunk reload deploy-server -class Class_Name -debug) There... by gitingua Communicator in Deployment Architecture 09-08-2022 0 0	0	0
Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations? Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/conf... by JoeSco27 Communicator in Deployment Architecture 09-08-2022 6 9	6	9
Unable to delete search results We are using 8.2.3 with SHC and multisite indexer clustering.We have some mismatch on key business data and we need t... by sylim_splunk Splunk Employee in Deployment Architecture 09-06-2022 1 1	1	1
How the red flag, "the percentage of small buckets", works? Hello everyone I have been trying to understand how this alert works because for my point of view doesn't make sense.... by glpadilla_sol Path Finder in Deployment Architecture 09-06-2022 0 2	0	2
Help with Windows dormant enable search Hi All, I want to create a use case where the account is inactive for 60 days and it got enable after 60 days.. I t... by debjit_k Path Finder in Deployment Architecture 09-05-2022 0 0	0	0
How to upgrade a single Search Head to a Search Head Cluster? Hello, please I would like to know if the best approach to "move" a single Search Head to a Search Head Cluster is t... by lucacaldiero Path Finder in Deployment Architecture 09-05-2022 0 3	0	3
Does it make sense to have a DR indexer be part of cluster? I inherited a splunk mesh of search-heads, deployment server, index cluster, etc. I am trying to figure out all this ... by HathMH Path Finder in Deployment Architecture 09-04-2022 0 4	0	4
If I have a Splunk DS version 9.0.1, what is the oldest version of Splunk UF that I can control, please? Dear All,I have about 100 Splunk UFs at 7.0.1, 7.3.5, 8.1.5, 8.2.5 and 9.0.0.1 and they are NOT being managed by a De... by BlueSocket Contributor in Deployment Architecture 09-02-2022 0 3	0	3
Can we configure input.conf define port with multiple sourcetype? Can we configure input.conf define port with multiple sourcetype? For ex. [tcp://6134]index = topsourcetype = mac_log... by ManojNegi New Member in Deployment Architecture 09-02-2022 0 1	0	1
The search job terminated unexpectedly in dashboard I am getting "The search job terminated unexpectedly" in the dashboard. In search, the index is working fine. And th... by rajesh01 Loves-to-Learn in Deployment Architecture 09-02-2022 0 3	0	3
Why is the latest version of the Forwarder Compatibility document still v 8.2.5, when we are on 9.0.1? Dear All/Splunk Documentation Team,I am trying to get to read the Compatibility between forwarders and Splunk Enterpr... by BlueSocket Contributor in Deployment Architecture 09-01-2022 0 1	0	1
How do I run diagnostic tools without root access? Hello, I have splunk starting up with systemd, and running as user splunk. I went to run the performance tasks on... by jason0 Path Finder in Deployment Architecture 08-31-2022 1 0	1	0
Add non-clustered indexer and standalone search head to existing cluster Hello,we had standalone search head and indexer in a pre-production environment then I created new clustered environm... by splunkreal Influencer in Deployment Architecture 08-31-2022 0 5	0	5
Why am I getting this error when Migrating from windows to linux? So i am in the process of migrating a distributed setup with 1 search head, 1 deployment/license server and 1 index s... by michaelnorup Communicator in Deployment Architecture 08-30-2022 0 8	0	8
What I can do to get the config in a Windows recognizable format? I have a distributed environment with a search head (with deployment server) and indexer. I SSH into the search head ... by InfinityATX Observer in Deployment Architecture 08-24-2022 0 1	0	1
User profile web UI option "Restart background jobs when the Splunk software is restarted" what does it actually do? This option exists under each users profile. This seems to imply that if a user submits a long running (ie. 2 hour... by Lucas_K Motivator in Deployment Architecture 08-24-2022 1 1	1	1
How can I find out what the deployment errors are? I see the following - How can I find out what the deployment errors are? The interface also warns about some sett... by ddrillic Ultra Champion in Deployment Architecture 08-24-2022 2 8	2	8
HomeLab Architecture Question Hello,I am a Splunk Enterprise Certified Admin who has an opportunity to advance to Splunk Architect with someone ret... by cjkoenig Explorer in Deployment Architecture 08-23-2022 0 9	0	9