Deployment Architecture

Discussions

Thread Info

The percentage of non high priority searches lagged (48%) over the last 24 hours is very high and exceeded the yellow th

Hi all, How can this be fixed? Thanks for your help on this,

by Loves-to-Learn Lots in

Expanding my splunk architecture

Currently, I have a single Splunk server that is performing all the necessary functions. However, I would like to exp...

by Path Finder in

to provide the list of P1C alerts for JMET cluster from Splunk

There is a request to provide the list of P1C alerts for JMET cluster from Splunkwe have provided the following quer...

by Loves-to-Learn Lots in

New inputs.conf Settings Not Applied After Pushing Configurations from Deployment Server (Splunk 9.2.1)

Hi Splunk community, I'm facing an issue with my Splunk deployment server, running on version 9.2.1 (splunk-9.2...

by Explorer in

app/launcher/home requires xml -- won't launch json dashboard

The classic dashboard format was xml; the new Dashboard Studio format is json. Our app/launcher/home is failing to lo...

by New Member in

Splunk Heavy Forwarder vs Universal Forwarder for large splunk instance

Hello Everyone, looking for a little guidance on our Splunk deployment for a system. Currently, we have a few diffe...

by Explorer in

Splunk bandwidth requirements

Dear All,I would like to introduced the DR Site along with active log ingestion (SH cluster + Indexers cluster ). i...

by Explorer in

Why this error on search head cluster after updating Splunk_TA_Windows?

I recently updated Splunk_TA_Windows and am seeing this error on my search head cluster:[Indexers] Could not load loo...

by Path Finder in

Why does the Monitoring Console not update with new indexer information?

I've replaced 2 or my 4 indexers in the cluster on an AWS deployment. The Indexer Cluster Status shows the right list...

by Explorer in

Can you still search logs on an indexer that is turned into a heavy forwarder

We have a legacy all-in-one Splunk server. We have built out a new distributed environment that has an indexer cluste...

by Builder in

SplunkEnterpriseSecurity App on ClusterMaster

Hi,While troubleshooting below error message: "The percentage of non high priority searches delayed (75%) over the...

by Engager in

join query issue

Hi allI am trying to fetch incident details from servicenow, but its showing duplicate values index=acn_le...

by Explorer in

I want to design a disitributed splunk architecture and need to know system requirements for components

Hi, I'm trying to design a distributed architecture of Splunk for my company, and I need to pitch the design to them....

by Path Finder in

How do i identify unneeded knowledge object

I've been requested to identify unused knowledge objects. I'm honestly not sure on the best way to go about this requ...

by Explorer in

How to deploy updates to inputs.conf, outputs.conf, and deploymentclient.conf files to the "C:\Program Files\Splunk\etc\system\local" directory?

I have created an app (which includes updates for the inputs.conf, outputs.conf and deploymentclient.conf files), an ...

by Communicator in

Why are deployment clients not showing up in deployment server?

The configurations are perfect and the ping and telnet are working between the deployment server and the client but a...

by Contributor in

Setting up a Splunk Dev Environment

So i have three servers in this Splunk infrastructure, a SH, an Indexer, and a forwarder. I have installed the free 1...

by Path Finder in

Install problems (feature is not available)

I am currently running Universal Forwarder 6.6.3 on a Windows 2012 R2 instance. I am attempting to upgrade to 7.1.1, ...

by New Member in

distsearch.conf and the web interface

when configuring a distributed search ... why when i create a new server on the web interface it asks for a username:...

by Contributor in

lookup does not recognized in apps & lookup file can do any other apps?

thanks to read and have a good day  1. we makes lookup file to use CSV File (in test enviroment), after then c...

by Engager in

What is the reason for search head errors expecting forwarder directory?

Dears, I am in the process of setting up a cluster environment. In the process while firing some commands on searc...

by New Member in

Fixing 502 errors when front-ending Search Heads with an AWS application load balancer?

We have a Splunk deployment in AWS and have our Search Head Cluster front-ended with an ALB (not ELB). Users frequent...

by Splunk Employee in

indexer cluster : colddb moved on a san share

Hello,Just have a question, about a test that I have in progress.I have one indexer cluster, with two servers.I decid...

by Explorer in

ProxySSO - Realname/Mail

Hey Splunkers, is there any way to use "Realname" and "Mail" within ProxySSO setup? We are using ProxySSO for aut...

by Engager in

Non replicated internal indexes

In the _cluster app on the cluster manager there is an indexes.conf file that specifically sets repFactor to 0 for th...

by Builder in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

The percentage of non high priority searches lagged (48%) over the last 24 hours is very high and exceeded the yellow th

Expanding my splunk architecture

to provide the list of P1C alerts for JMET cluster from Splunk

New inputs.conf Settings Not Applied After Pushing Configurations from Deployment Server (Splunk 9.2.1)

app/launcher/home requires xml -- won't launch json dashboard

Splunk Heavy Forwarder vs Universal Forwarder for large splunk instance

Splunk bandwidth requirements

Why this error on search head cluster after updating Splunk_TA_Windows?

Why does the Monitoring Console not update with new indexer information?

Can you still search logs on an indexer that is turned into a heavy forwarder

SplunkEnterpriseSecurity App on ClusterMaster

join query issue

I want to design a disitributed splunk architecture and need to know system requirements for components

How do i identify unneeded knowledge object

How to deploy updates to inputs.conf, outputs.conf, and deploymentclient.conf files to the "C:\Program Files\Splunk\etc\system\local" directory?

Why are deployment clients not showing up in deployment server?

Setting up a Splunk Dev Environment

Install problems (feature is not available)

distsearch.conf and the web interface

lookup does not recognized in apps & lookup file can do any other apps?

What is the reason for search head errors expecting forwarder directory?

Fixing 502 errors when front-ending Search Heads with an AWS application load balancer?

indexer cluster : colddb moved on a san share

ProxySSO - Realname/Mail

Non replicated internal indexes

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Index This | I am a number but I am countless. What am I?

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

Why are there multiple results from the reporting ...

How should EKS be configured for experimenting wit...

Setup Splunk on AWS Elastic Beanstalk

CMMC Version 2.0

Stream forwarder only works when running as root