Deployment Architecture

Community Activity

Corrupted bucket journal? Hi Everyone! I hope this isn't a "frequently solved problem." I've searched and googled for answers but I ran into a ... by clindseyssi Engager in Deployment Architecture 04-18-2020 3 9	3	9
What factors into how Splunk creates new hot buckets? Can anybody put some light on the factors based on why Splunk creates new Hot buckets?? Like maxDataSize and maxHotBu... by jitsinha Path Finder in Deployment Architecture 04-18-2020 0 3	0	3
How to find a stopped indexer from search head with SHC and IDC deployment I have a deployment with SHC and IDC (3 indexers), when I took down an indexer, all SHs would only see 2 search peers... by zhipengy_splunk Splunk Employee in Deployment Architecture 04-17-2020 0 6	0	6
how to restore TSIDX I am trying to execute the following command to restore TSIDX. splunk rebuild "bucket directory" What is correct t... by mcdp_matsumoto New Member in Deployment Architecture 04-16-2020 0 0	0	0
No spec file when validating bundle When trying to deploy a new cluster bundle I get errors with this verbage:[Not Critical]No spec file for: E:\Program... by computemoore78 New Member in Deployment Architecture 04-16-2020 0 1	0	1
Unable to add database connection for external lookups I am trying to add external database connection to be used in a lookup, however when I tried to add the database conn... by asaputra2610 New Member in Deployment Architecture 04-15-2020 0 0	0	0
Forwarder management UI shows delete record, what does it do? Title. What does delete record do? I have some problems with duplicate instance ID's which I've resolved but after re... by rnauman Explorer in Deployment Architecture 04-15-2020 2 4	2	4
Data Not found on indexer cluster Using Splunk Enterprise trail license : hi, I have forwarded a file to indexer cluster by installing universal forw... by shashi12345678 Engager in Deployment Architecture 04-13-2020 0 3	0	3
Error while deploying an app from the deployer Hi, I'm getting the below error while deploying an app from the deployer /opt/SP/apps/splunk/bin $ ./splunk apply shc... by Mohsin123 Path Finder in Deployment Architecture 04-13-2020 0 5	0	5
Splunk replication of old data I have a 5 node Indexer cluster with version 7.3.1.1. I added configuration to replicate data on indexer cluster but ... by rteja9 Path Finder in Deployment Architecture 04-13-2020 0 2	0	2
If I comment out the "enableTsidxReduction", will TSIDX be recreated? If I comment out the following settings, will TSIDX be recreated? enableTsidxReduction = true timePeriodInSecBeforeTs... by mcdp_matsumoto New Member in Deployment Architecture 04-13-2020 0 1	0	1
Netscaler AppFlow Independent Forwarder Hi, I am attempting to get some analytics from the Netscaler into Splunk via an Independent Forwarder using AppFlow p... by david2510 Engager in Deployment Architecture 04-11-2020 0 1	0	1
to establish connection between Indexer and searchhead Hi,During first time setup how to establish a connection between indexer and search head?In forwarder we are giving i... by VijaySrrie Builder in Deployment Architecture 04-11-2020 0 1	0	1
We have tested TSIDX reduction on one index and want to implement retention on the reduced buckets Hello All, We are having some storage capacity issues and trying some different things to make some space for the ing... by sathwikr076 Communicator in Deployment Architecture 04-10-2020 0 4	0	4
Does switching the SH captain help with clearing up expired and deleted jobs? We have expired and deleted jobs that don't clear. Does switching the SH captain, on a regular basis, help with clear... by danielbb Motivator in Deployment Architecture 04-09-2020 0 1	0	1
Is the installation file same for setting up splunk search head, indexer and deployment server? Is the installation file same for setting up splunk search head, indexer and deployment server? by ppanchal Path Finder in Deployment Architecture 04-08-2020 0 1	0	1
What does this WatchedFile error mean when monitoring a folder? While detecting legacy content headers, fileHalfMd5 returned an error ERROR WatchedFile - While detecting legacy content headers, fileHalfMd5 returned an error (path="\REMOTEHOST\dhcp\Dhc... by hurricane13 Engager in Deployment Architecture 04-08-2020 0 1	0	1
show unconfigured forwarders from deployment server search We use Deployment Server for managing all our universal forwarder inputs. I need to take an accounting of all devices... by some_guy Path Finder in Deployment Architecture 04-07-2020 0 2	0	2
Where do I place indexes.conf in an indexer clustering environment? Hi everyone, I have the indexes.conf, but I'm not sure where to place it inside my cluster environment. I thought I h... by Federica_92 Communicator in Deployment Architecture 04-06-2020 0 8	0	8
How to create a new index in an index cluster? I have 1 Master, 1 Search Head and 3 Index peers in my cluster. What is the Correct process for creating new indexes?... by Payne1882 Engager in Deployment Architecture 04-06-2020 2 8	2	8
Linux list users active, inactive, blocked or disable I want to find in my linux and unix environments which users are active, inactive, blocked or disable.I try looking i... by imontanoisoft Explorer in Deployment Architecture 04-04-2020 1 1	1	1
SIGTERM vs splunk stop Is there a difference how to stop Splunk: using splunk stop or to send TERM signal. I'm using kuberntes and it sends ... by davidgreenibm New Member in Deployment Architecture 04-04-2020 0 1	0	1
ArtifactReplicator - Connection failed I see below errors in the search head cluster.can some one helps resolve the issue? 02-11-2020 13:59:26.997 +0000 WA... by shivanandbm Explorer in Deployment Architecture 04-03-2020 0 8	0	8
Why Search Head become slow when can not connect to HF/IDX My environment is one Search Head -> one Heavy Forwerder -> 3 Indexers with Indexer Cluster. Search Head become sl... by dillencehsu Path Finder in Deployment Architecture 04-02-2020 0 7	0	7
Why is this indexer unable to get latest bundle from master? Hi Team, We are having an issue with Indexer not receiving updated code from master. I could see when we are pushi... by test_splunk15 Explorer in Deployment Architecture 04-01-2020 0 12	0	12