Deployment Architecture

Community Activity

Distributed Development About defining fixed roles meaningSh should only do searchIdx should only do indexingHf should only do log ingestion ... by Zombiesunday261 New Member in Deployment Architecture 11-20-2025 0 2	0	2
High Percentage of Small Buckets on Indexer – Mostly on _internal Index Hi Splunkers,I’m seeing a “Percentage of small buckets is high” health warning on one of my indexers.The alert shows:... by sanjai Communicator in Deployment Architecture 11-20-2025 0 1	0	1
Intermediate forwarder auditing Consider email headers which show all the steps involved in getting the email item from where it was sent to where it... by cmeo-bcit Explorer in Deployment Architecture 11-16-2025 0 5	0	5
Why is the metadata type=hosts command for *nix search heads showing incorrect lastTime and recentTime? I am using the metadata type=host command to alert me when a forwarder goes down and am now wanting to extend it to s... by hlarimer Communicator in Deployment Architecture 11-12-2025 1 12	1	12
Steps to Migrate Splunk Enterprise (All-in-One) Instance to a New Splunk Enterprise Cluster Hi everyone,I’m currently planning to migrate an existing Splunk Enterprise All-in-One instance (Search Head + Indexe... by rayleigh29 Explorer in Deployment Architecture 11-06-2025 0 1	0	1
How to configure Splunk Forwarder inputs.conf on multiple Windows clients (no Forwarder Management option shown) Hello everyone,I have a small lab environment with one Windows Server (running Splunk Enterprise Trial) and three Win... by Sam_Kurdy Engager in Deployment Architecture 11-03-2025 0 5	0	5
Splunk Attack Range v4 Local Ubuntu Hi!Is it possible to deploy a local attack range with Ubuntu? I read from splunk github repo that running this locall... by BrenDLSantos New Member in Deployment Architecture 10-23-2025 0 0	0	0
How Do I Move Data from my Indexes to an S3 Bucket in a Text or CSV format? Hi all,I'm looking for a way to copy all of the logging from an index to an S3 bucket on my company account.Ideally, ... by dexcare-techops Engager in Deployment Architecture 10-20-2025 0 3	0	3
How to enable clustering ? Hi,Please guide me how to enable clustering (splunk enable cluster-master, splunk edit cluster-config) for one insta... by _Raj Path Finder in Deployment Architecture 10-19-2025 0 5	0	5
What is the meaning of "LocalCollector - Final required fields list" and the list of fields afterward (in search.log)? What is the significance of the list of fields in "search.log", in the line that contains "INFO LocalCollector - Fin... by andrewaalin Explorer in Deployment Architecture 10-07-2025 3 2	3	2
Active Directory Deployment Failure in Splunk Attack Range Build I encountered an issue where the Active Directory configuration, despite being set in attack_range.yml, failed to pro... by zksvc Contributor in Deployment Architecture 10-05-2025 0 0	0	0
How to replicate non clustered buckets to clustered data Hi we wanted to migrate standalone indexer to multisite cluster, with 2 site.Below are my questions1. Can I find out... by bapun18 Communicator in Deployment Architecture 10-04-2025 0 2	0	2
Splunk Server OS Security patching Hello,Our operations team is supposed to perform OS Security patching on indexer cluster, search head, Heavy Forwarde... by maheshnc Path Finder in Deployment Architecture 09-25-2025 0 3	0	3
ingesting syslog data I want to ingest syslog from different devices like ESXI Hosts, firewalls (fortigate, palo alto), switches can somebo... by maheshnc Path Finder in Deployment Architecture 09-23-2025 0 9	0	9
KVStore does not start when running Splunk 9.4 I am posting this to maybe save you from few hours of troubleshooting like I did.I did clean install of Splunk 9.4 in... by MaverickT Communicator in Deployment Architecture 09-22-2025 0 7	0	7
Is there a limit to how many Search Heads can be part of a Cluster? Is there a limit to how many Search Heads can be part of a Cluster? We have a fairly large deployment and I wanted t... by katelynengel Explorer in Deployment Architecture 09-19-2025 1 8	1	8
How i can remove unused fields in extracted fields using "Delimiters" ? Hi all,I’m extracting fields from an event using the Field Extractor with a pipe (\|) delimiter for sourcetype=alert:a... by zksvc Contributor in Deployment Architecture 09-19-2025 0 3	0	3
Remote Upgrader for linux uf I have already deliver the splunk remote upgrader tgz ,with depoyment server.Can i deliver a script too to automatica... by ShawnXie Loves-to-Learn in Deployment Architecture 09-17-2025 0 5	0	5
Splunk Monitoring Console HA Set-up Hi,I have a requirement to implement the Splunk Monitoring Console (DMC) in a High Availability (HA) setup. At presen... by srek3502 Explorer in Deployment Architecture 09-10-2025 0 5	0	5
inflight file clean up In my indexer cluster, one of my indexers has inflight files in the cold and warm storage that range from 1.5-2 month... by huynha Explorer in Deployment Architecture 09-05-2025 1 4	1	4
SC4S vs “syslog servers tier” Why SC4S over a generic “syslog servers tier”1. It is Splunk’s best practice todaySplunk Validated Architectures call... by DanAlexander Communicator in Deployment Architecture 09-03-2025 0 1	0	1
Deployment Server: Duplicate clients after reinstalling the UF Hi I hope you are doing well. I have reinstalled the UF after that i found there are duplicate clients on the Deploym... by AliMaher Path Finder in Deployment Architecture 08-28-2025 0 4	0	4
Can universal forwarders have 2 different deployment server IPs in case the first fails? I have UFs in the DMZ and internal networks with a load balancer managing traffic between both zones. There is a sing... by StephenD1 Path Finder in Deployment Architecture 08-25-2025 0 8	0	8
splunkforwarder 9.x requires tty enabled in k8s sidecar? Hello folks,We are doing splunkforwarder upgrade to 9.4.x (from 8.x) recently, we build the splunk sidecar image for ... by kevinhsu New Member in Deployment Architecture 08-25-2025 0 1	0	1
Search head keeps failing in search head cluster This was the search head that kept failing: splunk > /appl/splunk/bin/splunk show shcluster-status -auth admin:admin... by zzhao05 New Member in Deployment Architecture 08-11-2025 0 5	0	5