Deployment Architecture

Community Activity

Index File Daily I have some files that I need to index daily even though they may not change in content for several days (for example... by duffeysplunk Path Finder in Deployment Architecture 06-11-2021 0 3	0	3
One or more hosts has returned CPU or memory specifications that fall below reference hardware recommendations. 'Monitoring Console' を使用して ‘Health Check’ を実行したところ以下のような Warning が出力されました。このまま運用し続けても問題はないでしょうか？英語One or more hosts h... by hnoboru_splunk Splunk Employee in Deployment Architecture 06-10-2021 0 1	0	1
Search head does not send search to all search peers Hi,My design: 1. Search Head: splunk-sh 2. My search peers: splunk-idx1 and splunk-idx2 3. My forwarders: splunk-fw1 ... by termcap Path Finder in Deployment Architecture 06-09-2021 0 1	0	1
DS running the Splunk_TA_nix Hi there! Can a deployment server run the TA *nix? I also have this TA deploying out to UFs, but lives under $SPLU... by shpot New Member in Deployment Architecture 06-09-2021 0 1	0	1
set up an alert for SHC members I have my Search head cluster in AWS and I am looking to set up an alert each time new SHC members get added to the S... by bsrikanthreddy5 Path Finder in Deployment Architecture 06-08-2021 0 1	0	1
Splunk Basic Questions Which component store data in splunk ?in which format data saved in splunk ?Can splunk configured to collect data fro... by Pranayamr New Member in Deployment Architecture 06-08-2021 0 1	0	1
Best practice: add indexers as search peers for the heavy forwarders ? When configuring data inputs on a heavy forwarder via the GUI (HEC, for instance), the destination index is requested... by yoho Contributor in Deployment Architecture 06-08-2021 0 6	0	6
indexer replication I stood up a new set of indexers this weekend and set my RF=2 and SF=1 on the CM with the hope that the old indexers ... by dkr3500 Path Finder in Deployment Architecture 06-07-2021 0 2	0	2
Migrate specific Indexes from Index cluster to new Index cluster HI Team,Today we have a 4 index cluster and we want to create a separate index cluster that does not share configurat... by dc595 Explorer in Deployment Architecture 06-04-2021 0 1	0	1
License for Deployment Server, Search heads and Heavy Forwarder Hi,Considering that the deployment server, Search Heads, Universal Forwarder and Deployers are full Splunk Enterprise... by termcap Path Finder in Deployment Architecture 06-04-2021 0 1	0	1
Splunk Periodic Cleanup Activities With Splunk for Windows and Splunk Enterprise Security. Are there specific periodic maintenance tasks that need to be... by tk111 Engager in Deployment Architecture 06-03-2021 0 3	0	3
Some cost calculation by counting the number of characters per line and grouping We want to work on some cost calculation by counting the number of characters per line and grouping the size per cust... by anil1432 Explorer in Deployment Architecture 06-01-2021 0 2	0	2
What should we do with the replication factor when half of the indexers are off? Half of the eight indexers will be off for potentially a day, so we'll have four indexers available for that time. Ou... by danielbb Motivator in Deployment Architecture 06-01-2021 0 1	0	1
Splunk does not switch to another index group when one fails Hi,I have the following outputs.conf on my Splunk Heavy Forwarder: defaultGroup = indx1 [tcpout:indx1] server=1.1.1.... by termcap Path Finder in Deployment Architecture 05-31-2021 0 4	0	4
NON CLUSTER INDEXERS ONE SEARCH HEAD - WHERE DO I UPDATE PROPS.CONF I inherited a one SH and 2 indexers , 1 LM, one Deployment server supporting forwarders.I have too on board data and... by jcorcoran508 Path Finder in Deployment Architecture 05-28-2021 0 3	0	3
Can Splunk send message to IBM Websphere MQ? Good day!I want to know if it's possible to use splunk as a recovery option?this means that Splunk will be sending me... by chiennylin New Member in Deployment Architecture 05-27-2021 0 0	0	0
What the best architecture for Head Office and Branch Office? Hello!We have two offices: Head and Branch. The Head office has a Splunk infrastructure (Enterprise Security), which ... by ipl New Member in Deployment Architecture 05-26-2021 0 1	0	1
List of possible reasons for hot buckets rolling to warm ("caller"?) We have been getting messages about high percentage of small buckets. I set logging to DEBUG on one of our indexers ... by mosmond Engager in Deployment Architecture 05-24-2021 1 3	1	3
HEC Log Drop During Bundle Reload Hi Splunkers,Good day. My HEC tokens are currently configured in the Indexer Cluster, and during Indexer Bundle Push ... by arielpconsolaci Path Finder in Deployment Architecture 05-23-2021 0 0	0	0
Implementing Splunk in PCI environment with Multiple PCI Zones One of our customer is looking to setup a SOC with a SIEM solution and they want to monitor and manage multiple PCI z... by Dograv New Member in Deployment Architecture 05-21-2021 0 1	0	1
How to produce empty time buckets In order to perform fast Fourier transform (FFT), I need data from equal time intervals. Here is my first attempt: \|... by yuanliu SplunkTrust in Deployment Architecture 05-21-2021 1 17	1	17
Indexer cluster in different datacenters Hi splunk community,In my environment I have 1 indexer each in 2 different datacenters, 1 searchhead, 1 clustermaster... by d_lim Path Finder in Deployment Architecture 05-20-2021 0 0	0	0
[SHClustering] one of 3 Searchheads is not starting after apps pushed to the members. pushed apps to the search head cluster to 3 Searchheads 2 of them working good but one searched URL is not accessible... by sylim_splunk Splunk Employee in Deployment Architecture 05-19-2021 0 1	0	1
Duplicate events in every index I can see that we are having duplicate events in every index, query used to identify the duplicate events:index=* \|ev... by snsaxena Loves-to-Learn Lots in Deployment Architecture 05-19-2021 0 0	0	0
Python Versions in Splunk 8.0 Hello Splunkers!Wish You are safe and healthy from this pandemic.I am using Splunk 8.0 Version, because it gives the ... by sarvesh_11 Communicator in Deployment Architecture 05-18-2021 0 7	0	7