Deployment Architecture

Community Activity

UBA Installation LVM Volume management Hi Everyone,I am in the process of installing Splunk UBA and have a question regarding the storage partitioning requi... by zksvc Contributor in Deployment Architecture 07-31-2025 0 6	0	6
Splunk Primary data not auto rolled to secondary after configuration change I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce ... by elend Communicator in Deployment Architecture 07-24-2025 0 8	0	8
Why drilldown using all-time in Enterprise Security Incident Review Hi Everyone, in default correlation search the name "Excessive Failed Logins" my drilldown cannot define $info_min_ti... by zksvc Contributor in Deployment Architecture 07-22-2025 3 10	3	10
UFW Access to WinEventLogs Hello All,We have a Splunk Universal Forwarder 9.4.0 (then 9.4.3) installed on a Windows 2022 box to which we don't h... by tsocyberoperati Loves-to-Learn Lots in Deployment Architecture 07-21-2025 0 5	0	5
The Client forwarder management not showing the clients Dears, After upgraded Splunk from 9.1.2 version to 9.2.0 version, the deployment server not showing the clients... by AAlhabba Explorer in Deployment Architecture 07-21-2025 1 29	1	29
Questions about data retention in Splunk Cloud (DDAS, DDAA) Hello! I'm new to Splunk Cloud. Could you please explain the difference between hot, warm, cold and thawed buckets in... by azer271 Path Finder in Deployment Architecture 07-20-2025 0 4	0	4
How to move index from one hard drive to another in Splunk clustered environment? Hi everyone, I am working on Splunk clustered environment, where i have 3 indexers,1 search head, and 1 head. Now i a... by thambisetty SplunkTrust in Deployment Architecture 07-18-2025 3 13	3	13
what is ExecStartPost in systemd unit itended for? Hi all,When creating a systemd unit file for and old UF (<9.1) using "splunk enable boot-start -systemd-managed 1 -us... by schose Builder in Deployment Architecture 07-15-2025 0 2	0	2
Heavy Forwarder Not Indexing My End Goal: I would like to be able to leverage our windows Splunk deployment server/Splunk enterprise server to rec... by Cole-Potter Loves-to-Learn Lots in Deployment Architecture 07-14-2025 0 5	0	5
Is it possible to encrypt an index in my Splunk instance? I have a group of indexes, one of which contains sensitive data that must be encrypted so that no one can copy and up... by spy_jr Explorer in Deployment Architecture 07-14-2025 0 6	0	6
Adding a hot and cold storage solution to a distributed clustered splunk environment Hi everyone,I’m currently working with a Splunk distributed clustered environment (v9.4.1), with 3 indexers, 3 search... by ASGrover Loves-to-Learn Lots in Deployment Architecture 07-08-2025 0 3	0	3
State of SIR in ServiceNow not capturing HiI have created a playbook to capture inputs from the user like short description, description and priority and crea... by Sidpet Loves-to-Learn in Deployment Architecture 07-07-2025 0 0	0	0
Download Splunk Enterprise 9.0 Hi,I need to upgrade Splunk v.8.2.2.1 on RHEL 7.6 to Splunk v.9.4 on RHEL 9.6.I saw that Splunk 8.2 does not support ... by mbissante Engager in Deployment Architecture 06-27-2025 0 2	0	2
SC4S with Keepalived Hello,2 questions but the second is more of a keepalived question than it is an SC4S question.First question is what ... by L_Petch Path Finder in Deployment Architecture 06-26-2025 0 4	0	4
add/modify kvstore column in search head cluster environment I have a question about modify kvstore configuration in search head cluster environment. I have created kvstore with ... by karn Path Finder in Deployment Architecture 06-25-2025 0 4	0	4
Forwarder Management All clients phoning home later than expected We have a stand-alone splunk instance in a closed area. We had to roll back the server to a snapshot and now the clie... by sdiaz5796 Loves-to-Learn Lots in Deployment Architecture 06-23-2025 0 5	0	5
CSV lookup files distribution to all instances in a Splunk cluster? Hello there! I am currently managing a Splunk Enterprise clustered environment, where I have implemented a scheduled ... by vnetrebko Explorer in Deployment Architecture 06-20-2025 0 3	0	3
RF and SF are not meeting up Suddenly we observed /opt/data was unmounted, and ownership has changed from splunk to root. Mounted back and restart... by sandeep_A1997 Loves-to-Learn in Deployment Architecture 06-19-2025 0 3	0	3
Does a props/transforms.conf Visio stencil exist? I see multiple versions of the inputs.conf Visio stencil however I'm looking for props.conf and transforms.conf ones.... by danielbb Motivator in Deployment Architecture 06-19-2025 0 1	0	1
How to take back up and restore saved searches in a search head clustered environment by Jflow Splunk Employee in Deployment Architecture 06-17-2025 0 1	0	1
Error Ingest Data AWS Cloudtrail "error=Traceback (most recent call last):" Hi Everyone, I encountered an error while ingesting sourcetype=aws:cloudtrails in AWS Apps. I attempted to ingest dat... by zksvc Contributor in Deployment Architecture 06-11-2025 0 3	0	3
Configure SAML authentication for a search head cluster using Amazon Application Load Balancer Hello, I am Looking for details of anyone that has successfully setup a enterprise search head cluster that is behind... by lrader Observer in Deployment Architecture 06-05-2025 0 1	0	1
Playbook not showing Hi I have created a playbook and am trying to run it from an event. But the playbook does not populate when I click o... by Sidpet Loves-to-Learn in Deployment Architecture 06-05-2025 0 1	0	1
Splunk SOAR playbook Crowdstrike validation I have playbook that validates a url given and assigns scores to it. I am able to run the playbook successfully but d... by Sidpet Loves-to-Learn in Deployment Architecture 06-04-2025 0 3	0	3
Openshift Support for Splunk Universal Forwarder Docker Image The splunk universal forwarder image currently is not compatible with OpenShift. The image architecture requires the ... by _KD Engager in Deployment Architecture 06-04-2025 0 2	0	2