Deployment Architecture

Community Activity

Hot/Warm and Cold Storage We are in the process increase our daily ingest rate to 2TB, and I want to ask the questions about our storage retent... by panpanbebe New Member in Deployment Architecture 02-12-2021 0 5	0	5
Unable to remove header from CSV file pulling from S3 Can someone help here please. I'm trying to remove the header which is currently adding as header as a events in the ... by rajasha Explorer in Deployment Architecture 02-12-2021 0 3	0	3
serverclass.conf blacklisting and white listing I have multiple severs that have been blacklistedblacklist.0 = nonprod* I am trying to blacklist all except for nonpr... by parmenion_natha Explorer in Deployment Architecture 02-12-2021 0 5	0	5
Challenges on boarding auto-scaling application to splunk on prem environment Hi All,Can you please help to understand the challenges on boarding auto-scaling application data into splunk on pre... by btshivanand Path Finder in Deployment Architecture 02-11-2021 0 1	0	1
Events for an index are not retained per desired retention policies I have an index for which I desire to retain 45 days of events .I have multiple values set under indexes.conf for the... by sagaraverma Loves-to-Learn Everything in Deployment Architecture 02-11-2021 0 2	0	2
Steps to add additional storage to Indexers in cluster Hi Splunkers ,Our splunk indexers disk has reached 90% and decided to extend the capacity. We have 3 indexers in clus... by spl_unker Explorer in Deployment Architecture 02-11-2021 1 1	1	1
Getting logs from S3 to Splunk Hi Splunkers , We have decided to use S3 as centralized collection of logs from various sources. I have the following... by spl_unker Explorer in Deployment Architecture 02-10-2021 0 0	0	0
Best practice to move Splunk indexers servers. Hello all,We have Splunk Multisite Indexer Cluster in 2 different data centers. Each Site has 3 nodes in the Cluster ... by GersonGarcia Path Finder in Deployment Architecture 02-08-2021 0 1	0	1
Upgrade Splunk Deployment Hi!I´m looking for your help because I want to upgrade my Splunk deployment. Currently, I have all my forwarders runn... by malopez_riv Engager in Deployment Architecture 02-08-2021 0 1	0	1
Splunk add-on for windows infrastructure I am not receiving data in my windows infrastructure search headmsad is enabled but not reading any data by mysplunkbase Explorer in Deployment Architecture 02-04-2021 0 1	0	1
UF establishes connection to DS, then it resets connection and is not seen in DS Hi,Splunk noob here.I cannot get a deployment client to show up in deployment server.turned DEBUG on splunkd.log and ... by rafaelruales Explorer in Deployment Architecture 02-03-2021 0 1	0	1
Monitoring Console(MC) and Clustered Indexers. MC is only seeing indexers on one site meanwhile cluster includes two sites Have a server that performs my indexer clustering where my 20 indexers(10 per site) check in. On my monitoring consol... by santorof Communicator in Deployment Architecture 02-03-2021 0 3	0	3
Indexing issues Hi, In Splunk's internal log file I can see the log file was processed by Splunk to index, but when I am trying to se... by bsrikanthreddy5 Path Finder in Deployment Architecture 02-02-2021 0 2	0	2
Distributed deployment and MC: Do I need to add SH if the SH is sending its data to IDX cluster? Hi community.Just preparing for my ARCH practical lab. I heard that it's mandatory to add to the MC the non clustered... by MLGSPLUNK Path Finder in Deployment Architecture 02-02-2021 0 2	0	2
Ingest large number of csv files I have a backlog of huge number of .csv file skipped by the UF need to be ingested manually to back fill. What is the... by msplunk33 Path Finder in Deployment Architecture 01-31-2021 0 3	0	3
How do I see what Splunk components are in my enviornment? Good Morning Everyone! I am trying to see what components are in my Splunk environment. I just inherited a system wi... by ochoa165 Explorer in Deployment Architecture 01-27-2021 0 2	0	2
Best Practice when managing remote Heavy Forwarders / Deployment Servers What would be considered the Splunk best practice when managing multiple deployment servers in different locations th... by travislelledeep Explorer in Deployment Architecture 01-25-2021 0 3	0	3
Search Head Cluster (SHC) memebers not recieving password from Deployer I have an add on installed in Deployer which has been configured with Credentials and is working fine. But when i se... by ravi Loves-to-Learn Lots in Deployment Architecture 01-21-2021 0 1	0	1
UF parallelization for Splunk Cloud I'm looking for advice for avoiding the 'Funnel Effect' for a small number of intermediate Universal Forwarders to ab... by X_Kinkead Explorer in Deployment Architecture 01-21-2021 0 2	0	2
Log Retention Period Change I want to set up the retention policy for our logs (18 months). I have edited the indexes.conf to specify frozenTimeP... by DawidM Explorer in Deployment Architecture 01-21-2021 0 5	0	5
On a Splunk Enterprise deployer, how do I change the default time selection on a search head cluster? I have a Splunk instance that I'm using as a deployer called halfiron. I created user-prefs.conf in this directory. (... by halbeisendv Path Finder in Deployment Architecture 01-20-2021 0 11	0	11
Turn non clustered indexers into clustered indexer Hi all,I have an architecture with a search head cluster (3 members) and and 2 indexers, that are not in cluster.Whic... by lucacaldiero Path Finder in Deployment Architecture 01-19-2021 0 2	0	2
Send data to 2 indexers Hello everyoneI need help to send information to 2 indexers.By request of the client I need to send information from ... by edgarsilva01 Path Finder in Deployment Architecture 01-19-2021 0 2	0	2
Splunk Cloud - Heavy Forwarders : Not Sending logs Hello there,Is there any way to either configure an alert when the heavy forwarders are not sending logs in splunk cl... by sting663 New Member in Deployment Architecture 01-18-2021 0 1	0	1
How to reset the _TCP_ROUTING dest key Please assume the below in transforms.conf[send_rawevents] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = indexer1 [send... by efika Communicator in Deployment Architecture 01-18-2021 0 0	0	0