Deployment Architecture

Community Activity

How do I use the same data model on multiple search heads? Hi, I have 2 independent Search Heads (SH) (no clustering) and they use the same indexers. On the first SH: I have... by secuc2r83 Path Finder in Deployment Architecture 02-17-2020 0 10	0	10
Why is the search head status is flickering in the indexer clustering?` Search heads are up and healthy, but there is a fluctuation in the Search head status in the indexer clustering. Can... by AbilashSe Explorer in Deployment Architecture 02-17-2020 0 5	0	5
Backup Indexes to S3 without Hadoop Here's the situation - we have a non-developer, new to Splunk, without access to Hadoop (or any basic understanding o... by jbruce506 Explorer in Deployment Architecture 02-16-2020 0 1	0	1
Enabling HTTP Event Collector using a deployment-app buggy Environment: Splunk version: 7.2.5 Distributed deployment with multiple Heavy Forwarders managed by Deploymentserver.... by tberres1987 New Member in Deployment Architecture 02-15-2020 0 1	0	1
How to split data from old indexer to new indexers. I have a setup right now where we have 1 indexer in our test environment and we are putting 2 new indexers in the pro... by brent89567 New Member in Deployment Architecture 02-15-2020 0 2	0	2
how do I add an app from Splunkbase to Splunk 7.01? I want to add the app Splunk Dashboard examples to my 7.01 environment. As soon as I select find new apps I get the e... by mjltls New Member in Deployment Architecture 02-14-2020 0 1	0	1
Indexer not indexing data My Cisco Indexer just stopped indexing new data. Splunk is receiving data from the Syslog server but just not getting... by afolabia Path Finder in Deployment Architecture 02-13-2020 0 4	0	4
Is the AMD Rome EPYC architecture a valid option now? I've been poking around the interwebs trying to figure out if there is a benefit/downside to going with the new AMD R... by icehawk55 New Member in Deployment Architecture 02-13-2020 0 1	0	1
Will there be any impact on performance of search head if we add many indexer peer to it? Hi, Wanted to know if there could be any impact on performance of a search head, if we add many indexer peer to a sin... by saurabh0912 Path Finder in Deployment Architecture 02-13-2020 0 3	0	3
Migrating Splunk Enterprise instances to new servers, what steps do I need to follow with a deployment server? I currently have a Splunk environment that consists of: 1 License Manager/Deployment Server 1 Search Head 2 Indexers ... by lyndac Contributor in Deployment Architecture 02-12-2020 0 2	0	2
Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? We have a not-at-all overloaded ES search head with a separate volume for dispatch with plenty of room that gives us ... by woodcock Esteemed Legend in Deployment Architecture 02-12-2020 0 1	0	1
How do I figure out what the real problem is with my index cluster? After several years the replication factor on my 6.6.3 index cluster recently changed to 'not met'. it has been fine... by duke_splunk_adm Engager in Deployment Architecture 02-11-2020 0 4	0	4
captain SHC recommendation Good afternoon Is there splunk documentation where it is reported that in a SHC the servers must be certified at ... by efaundez Path Finder in Deployment Architecture 02-11-2020 0 5	0	5
How many buckets created by default in Splunk Cloud for an index? I am using Splunk Cloud environment. I am interested to know how many buckets created for an index and what will be d... by bsuresh1 Path Finder in Deployment Architecture 02-11-2020 0 1	0	1
Hard disk Failure on One Index in a Cluster Hi all, Our environment consists of, amongst other things, a multisite (3) clustered environment. Each site has thre... by mark_wymer Path Finder in Deployment Architecture 02-11-2020 0 2	0	2
Bug? Drilldown search causes "error:113", in dashboard Edit mode I have two dashboards with custom drilldown search. One of them works just fine. But the other returns a blank page... by yuanliu SplunkTrust in Deployment Architecture 02-10-2020 0 2	0	2
How does the bucket system work in Splunk Cloud Hi Team, We were using Splunk Enterprise for last few years. And recently by May 2019 we have migrated all the data ... by anandhalagaras1 Contributor in Deployment Architecture 02-10-2020 0 6	0	6
About rentention specification of index After importing DBConect data, Although the rentention of the index is a day ago, It is kept for 5 days. Does splunk ... by nishida_tada_ca Loves-to-Learn Lots in Deployment Architecture 02-10-2020 0 1	0	1
Unable to add search peer from search head using distributed search :no route to host or connection refused Issue:Unable to add search peer from search head using distributed search :no route to host or connection refused err... by RK_sp1unk New Member in Deployment Architecture 02-09-2020 0 3	0	3
Can't see newly created indexes on search head in distributed search I have a single indexer and single search head with the indexer attached as a search peer and I created one index cal... by kjstogn Explorer in Deployment Architecture 02-08-2020 0 1	0	1
Multi-site Indexer rolling restart - indexer fails to restart/timeout Using Splunk 7.3.3, after I initiated a rolling restart from the cluster master (multi-site indexer cluster), the fi... by DEAD_BEEF Builder in Deployment Architecture 02-08-2020 1 6	1	6
How can i monitor linux commands in splunk I have 2 servers in place (linux), and would like to monitor the command hit at putty. Is there any way where we can ... by kalpesh11 New Member in Deployment Architecture 02-07-2020 0 7	0	7
Why am I not receiving events into Splunk enterprise from the remote splunk forwarder? I have an enterprise and a forwarder on the remote system Mid Jan 2020 I am not receiving any events from the forward... by jerrin Explorer in Deployment Architecture 02-06-2020 0 1	0	1
Why do I get a massive amount of TcpOutputProc on my search head ? I have a search head cluster (3 search heads) and an indexer cluster (3 indexers). More than 10% of splunkd.log (on m... by yoho Contributor in Deployment Architecture 02-06-2020 1 2	1	2
Many buckets in "Cannot fix up primary restoration as previous mask change is in progress" state Using Indexer Clustering 7.0.4 and after some network outage issues I am getting 8600+ buckets with below pending fix... by cweiliou_splunk Splunk Employee in Deployment Architecture 02-05-2020 0 2	0	2