Deployment Architecture

Community Activity

Microsoft o365 app for splunk Folks,I would like to know what name of index you recommend for o365 audit logs via the Microsoft o365 add-on for spl... by trojan_81 Path Finder in Deployment Architecture 10-31-2020 1 2	1	2
Compatibility between search head in splunkcloud and on-prem search head Hello All,Our SH in Splunk cloud will be upgraded to 7.2.10.2 from v7.0.13. Our on - prem SH is on 7.0.5.As per the d... by km1986 Path Finder in Deployment Architecture 10-30-2020 0 1	0	1
[Smartstore] Is there a way to manually upload the bucket to smartstore. We notice that due to some reason some of the buckets never got loaded to the remote store. IS it feasible to upload ... by rbal_splunk Splunk Employee in Deployment Architecture 10-29-2020 0 2	0	2
Using Heavy Forwarder as a Relay I've seen the warnings of having UFs sending HFs and relaying to a index cluster. The objection seems to be around un... by dokaas_2 Communicator in Deployment Architecture 10-28-2020 0 1	0	1
Changing the IP of a SHC member Hi everyone, so one of our SHC member will be moved to another datacenter, as such the IP assigned will be different.... by d_lim Path Finder in Deployment Architecture 10-28-2020 1 0	1	0
Firehose to Splunk Cloud Has anybody implemented Firehose to Splunk cloud destination? Was wondering how the connection is made and if it can ... by bonf_bhai Loves-to-Learn in Deployment Architecture 10-27-2020 0 1	0	1
How to reduce the search factor to 2 from 3? Hello Splunkers,I have one requirement where have 3 sites and planning to keep the search factor to 2 and replication... by arunsunny Path Finder in Deployment Architecture 10-27-2020 1 5	1	5
Bucket corruption error Hi all,We have an environment with 3 IDX in cluster. One of them (splunk_idx1) fall and when it recovers, messages li... by pbalbasdtt Path Finder in Deployment Architecture 10-23-2020 2 1	2	1
Can a Index Cluster master use it self for forwarding data to the Cluster peers? Hi All.I was thinking about the configuration af an Index Cluster Deployer (formerly known as Master), where best pra... by las Builder in Deployment Architecture 10-23-2020 1 2	1	2
Forwarder Indexer Compatibility Is Universal Forwarder version 7.1.X compatible with that of Indexer version 8.0.X? by sanjubaba Path Finder in Deployment Architecture 10-22-2020 0 1	0	1
Is it possible to set site_search_factor = origin:1, site4:0, total:3 in a multisite indexer cluster to restrict searchable data being indexed to a specific site? Hi Team, I have a theoretical question about multisite indexer clustering. As site_replication_factor is how many... by hazclan13 Engager in Deployment Architecture 10-20-2020 0 5	0	5
How to resolve error "Error pulling configurations from the search head cluster captain"? I am getting the error "Error pulling configurations from the search head cluster captain; consider performing a dest... by mintughosh Path Finder in Deployment Architecture 10-20-2020 1 9	1	9
How is disc space allocated to indexes on indexer? We have a set of non clustered indexers. around 20. There is a duplicate entry of an index definition in indexes.conf... by goelt2000 Explorer in Deployment Architecture 10-19-2020 0 1	0	1
Deployment Server over old config management Hi there,What is the best way to approach attaching a DS to an environment that is already in place and scattered wit... by mwdbhyat Builder in Deployment Architecture 10-19-2020 1 1	1	1
Are there any ideal exceptions where DS has to be on windows when most of the servers are windows? We are planning to have DS linux based which would be used to deploy majorly on Windows servers and few Linux based s... by jonwick Path Finder in Deployment Architecture 10-18-2020 1 2	1	2
syslog logs are missing I am using linux rsyslog server to capture syslog from Cisco ASA firewall and send to the splunk using the universal ... by msplunk33 Path Finder in Deployment Architecture 10-18-2020 1 4	1	4
How to upgrade Splunk Universal Forwarder to a New Version in Ubuntu Linux? How to upgrade Splunk Universal Forwarder to a New Version in Ubuntu Linux? by sanjubaba Path Finder in Deployment Architecture 10-18-2020 0 6	0	6
Arcsight to Splunk Cloud We are checking NIFI option o send data to splunk cloud HEC via proxy, Can you Please suggest by sahiltcs Path Finder in Deployment Architecture 10-15-2020 0 1	0	1
Ansible Playbook - Splunk UF deployment on Windows servers Does anyone know where I can find an Ansible playbook for deploying Splunk UF's on Windows servers. I have found seve... by adnankhan5133 Communicator in Deployment Architecture 10-15-2020 0 1	0	1
Bootstrapping a secure management configuration with company certificates Distributing certificates to forwarders for the indexer configuration works fine in Splunk. But what about the manage... by afx Contributor in Deployment Architecture 10-14-2020 2 1	2	1
What happens to the Search head Data after you migrate from signal install to cluster HiWe are moving from a single install to a cluster.The production machine is going to be used as a search head, can w... by robertlynch2020 Influencer in Deployment Architecture 10-14-2020 0 2	0	2
merge indexes.conf files I have a task to take a list of active Indexes and create a new configuration file entry in a merged file, using a bu... by kembgeorge Loves-to-Learn in Deployment Architecture 10-14-2020 0 3	0	3
Splunk Indexed Data Backup Can we take full backup of entire var directory on the Splunk indexer machine if we have enough available space? by sanjubaba Path Finder in Deployment Architecture 10-14-2020 1 1	1	1
Do we need to install all apps for indexers in cluster ? Hello,We are planning to move from Single instance installation to cluster(1SH + 3 INDEXER)we have 50+ supporting app... by AKG1_old1 Builder in Deployment Architecture 10-14-2020 0 3	0	3
Identification of Splunk Installation Method How to identify whether the Splunk installation is done by a root or a non-root user on Ubuntu Linux machine?Can some... by sanjubaba Path Finder in Deployment Architecture 10-13-2020 0 2	0	2