Deployment Architecture

Community Activity

inflight file clean up In my indexer cluster, one of my indexers has inflight files in the cold and warm storage that range from 1.5-2 month... by huynha Explorer in Deployment Architecture 09-05-2025 1 4	1	4
SC4S vs “syslog servers tier” Why SC4S over a generic “syslog servers tier”1. It is Splunk’s best practice todaySplunk Validated Architectures call... by DanAlexander Communicator in Deployment Architecture 09-03-2025 0 1	0	1
Deployment Server: Duplicate clients after reinstalling the UF Hi I hope you are doing well. I have reinstalled the UF after that i found there are duplicate clients on the Deploym... by AliMaher Path Finder in Deployment Architecture 08-28-2025 0 4	0	4
Can universal forwarders have 2 different deployment server IPs in case the first fails? I have UFs in the DMZ and internal networks with a load balancer managing traffic between both zones. There is a sing... by StephenD1 Path Finder in Deployment Architecture 08-25-2025 0 8	0	8
splunkforwarder 9.x requires tty enabled in k8s sidecar? Hello folks,We are doing splunkforwarder upgrade to 9.4.x (from 8.x) recently, we build the splunk sidecar image for ... by kevinhsu New Member in Deployment Architecture 08-25-2025 0 1	0	1
Search head keeps failing in search head cluster This was the search head that kept failing: splunk > /appl/splunk/bin/splunk show shcluster-status -auth admin:admin... by zzhao05 New Member in Deployment Architecture 08-11-2025 0 5	0	5
Settings for 1year retention period I have this small Splunk Enterprise deployment in a lab that's air gapped.So I setup this deployment about 18 months ... by jkamdar Communicator in Deployment Architecture 08-06-2025 0 5	0	5
How can I deploy the TA_nix on the deployment server? What would be the proper way to deploy the TA_nix on the deployment server, is the reload option available or do I ne... by danielbb Motivator in Deployment Architecture 08-05-2025 0 5	0	5
How does the deployment server deploy to itself? I have two DSs that fail to deploy the TA_nix to themselves, how is it normally done? meaning how does the deployment... by danielbb Motivator in Deployment Architecture 08-04-2025 0 6	0	6
UBA Installation LVM Volume management Hi Everyone,I am in the process of installing Splunk UBA and have a question regarding the storage partitioning requi... by zksvc Contributor in Deployment Architecture 07-31-2025 0 6	0	6
Splunk Primary data not auto rolled to secondary after configuration change I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce ... by elend Communicator in Deployment Architecture 07-24-2025 0 8	0	8
Why drilldown using all-time in Enterprise Security Incident Review Hi Everyone, in default correlation search the name "Excessive Failed Logins" my drilldown cannot define $info_min_ti... by zksvc Contributor in Deployment Architecture 07-22-2025 3 10	3	10
UFW Access to WinEventLogs Hello All,We have a Splunk Universal Forwarder 9.4.0 (then 9.4.3) installed on a Windows 2022 box to which we don't h... by tsocyberoperati Loves-to-Learn Lots in Deployment Architecture 07-21-2025 0 5	0	5
The Client forwarder management not showing the clients Dears, After upgraded Splunk from 9.1.2 version to 9.2.0 version, the deployment server not showing the clients... by AAlhabba Explorer in Deployment Architecture 07-21-2025 1 29	1	29
Questions about data retention in Splunk Cloud (DDAS, DDAA) Hello! I'm new to Splunk Cloud. Could you please explain the difference between hot, warm, cold and thawed buckets in... by azer271 Path Finder in Deployment Architecture 07-20-2025 0 4	0	4
How to move index from one hard drive to another in Splunk clustered environment? Hi everyone, I am working on Splunk clustered environment, where i have 3 indexers,1 search head, and 1 head. Now i a... by thambisetty SplunkTrust in Deployment Architecture 07-18-2025 3 13	3	13
what is ExecStartPost in systemd unit itended for? Hi all,When creating a systemd unit file for and old UF (<9.1) using "splunk enable boot-start -systemd-managed 1 -us... by schose Builder in Deployment Architecture 07-15-2025 0 2	0	2
Heavy Forwarder Not Indexing My End Goal: I would like to be able to leverage our windows Splunk deployment server/Splunk enterprise server to rec... by Cole-Potter Loves-to-Learn Lots in Deployment Architecture 07-14-2025 0 5	0	5
Is it possible to encrypt an index in my Splunk instance? I have a group of indexes, one of which contains sensitive data that must be encrypted so that no one can copy and up... by spy_jr Explorer in Deployment Architecture 07-14-2025 0 6	0	6
Adding a hot and cold storage solution to a distributed clustered splunk environment Hi everyone,I’m currently working with a Splunk distributed clustered environment (v9.4.1), with 3 indexers, 3 search... by ASGrover Loves-to-Learn Lots in Deployment Architecture 07-08-2025 0 3	0	3
State of SIR in ServiceNow not capturing HiI have created a playbook to capture inputs from the user like short description, description and priority and crea... by Sidpet Loves-to-Learn in Deployment Architecture 07-07-2025 0 0	0	0
Download Splunk Enterprise 9.0 Hi,I need to upgrade Splunk v.8.2.2.1 on RHEL 7.6 to Splunk v.9.4 on RHEL 9.6.I saw that Splunk 8.2 does not support ... by mbissante Engager in Deployment Architecture 06-27-2025 0 2	0	2
SC4S with Keepalived Hello,2 questions but the second is more of a keepalived question than it is an SC4S question.First question is what ... by L_Petch Path Finder in Deployment Architecture 06-26-2025 0 4	0	4
add/modify kvstore column in search head cluster environment I have a question about modify kvstore configuration in search head cluster environment. I have created kvstore with ... by karn Path Finder in Deployment Architecture 06-25-2025 0 4	0	4
Forwarder Management All clients phoning home later than expected We have a stand-alone splunk instance in a closed area. We had to roll back the server to a snapshot and now the clie... by sdiaz5796 Loves-to-Learn Lots in Deployment Architecture 06-23-2025 0 5	0	5