Deployment Architecture

Community Activity

Custom audit path with rlog.sh Hi, I have audit data coming from a port (UDP) to Heavy Forwarder[via syslog] and have to apply rlog.sh on the same.... by payal23 Path Finder in Deployment Architecture 02-20-2020 0 3	0	3
Splunk Forwarder connection to Cluster Master Hi All, I am trying to build a query through which we can track if all the Splunk forwarders are connected to Cluste... by samadmemon Explorer in Deployment Architecture 02-18-2020 0 7	0	7
How to specify the storage ratio? Hi, splunkers: Is there any way to special the storage ratio? Like 30% log store on indexer A and the other 70% sto... by aojie654 Path Finder in Deployment Architecture 02-17-2020 0 4	0	4
Is there a way to share a Data Model across 2 Search Head Clusters Hi, We would like to use the same Data Model (same field extractions, same events, same acceleration window, etc.) i... by ctaf Contributor in Deployment Architecture 02-17-2020 1 4	1	4
How do I use the same data model on multiple search heads? Hi, I have 2 independent Search Heads (SH) (no clustering) and they use the same indexers. On the first SH: I have... by secuc2r83 Path Finder in Deployment Architecture 02-17-2020 0 10	0	10
Why is the search head status is flickering in the indexer clustering?` Search heads are up and healthy, but there is a fluctuation in the Search head status in the indexer clustering. Can... by AbilashSe Explorer in Deployment Architecture 02-17-2020 0 5	0	5
Backup Indexes to S3 without Hadoop Here's the situation - we have a non-developer, new to Splunk, without access to Hadoop (or any basic understanding o... by jbruce506 Explorer in Deployment Architecture 02-16-2020 0 1	0	1
Enabling HTTP Event Collector using a deployment-app buggy Environment: Splunk version: 7.2.5 Distributed deployment with multiple Heavy Forwarders managed by Deploymentserver.... by tberres1987 New Member in Deployment Architecture 02-15-2020 0 1	0	1
How to split data from old indexer to new indexers. I have a setup right now where we have 1 indexer in our test environment and we are putting 2 new indexers in the pro... by brent89567 New Member in Deployment Architecture 02-15-2020 0 2	0	2
how do I add an app from Splunkbase to Splunk 7.01? I want to add the app Splunk Dashboard examples to my 7.01 environment. As soon as I select find new apps I get the e... by mjltls New Member in Deployment Architecture 02-14-2020 0 1	0	1
Indexer not indexing data My Cisco Indexer just stopped indexing new data. Splunk is receiving data from the Syslog server but just not getting... by afolabia Path Finder in Deployment Architecture 02-13-2020 0 4	0	4
Is the AMD Rome EPYC architecture a valid option now? I've been poking around the interwebs trying to figure out if there is a benefit/downside to going with the new AMD R... by icehawk55 New Member in Deployment Architecture 02-13-2020 0 1	0	1
Will there be any impact on performance of search head if we add many indexer peer to it? Hi, Wanted to know if there could be any impact on performance of a search head, if we add many indexer peer to a sin... by saurabh0912 Path Finder in Deployment Architecture 02-13-2020 0 3	0	3
Migrating Splunk Enterprise instances to new servers, what steps do I need to follow with a deployment server? I currently have a Splunk environment that consists of: 1 License Manager/Deployment Server 1 Search Head 2 Indexers ... by lyndac Contributor in Deployment Architecture 02-12-2020 0 2	0	2
Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? We have a not-at-all overloaded ES search head with a separate volume for dispatch with plenty of room that gives us ... by woodcock Esteemed Legend in Deployment Architecture 02-12-2020 0 1	0	1
How do I figure out what the real problem is with my index cluster? After several years the replication factor on my 6.6.3 index cluster recently changed to 'not met'. it has been fine... by duke_splunk_adm Engager in Deployment Architecture 02-11-2020 0 4	0	4
captain SHC recommendation Good afternoon Is there splunk documentation where it is reported that in a SHC the servers must be certified at ... by efaundez Path Finder in Deployment Architecture 02-11-2020 0 5	0	5
How many buckets created by default in Splunk Cloud for an index? I am using Splunk Cloud environment. I am interested to know how many buckets created for an index and what will be d... by bsuresh1 Path Finder in Deployment Architecture 02-11-2020 0 1	0	1
Hard disk Failure on One Index in a Cluster Hi all, Our environment consists of, amongst other things, a multisite (3) clustered environment. Each site has thre... by mark_wymer Path Finder in Deployment Architecture 02-11-2020 0 2	0	2
Bug? Drilldown search causes "error:113", in dashboard Edit mode I have two dashboards with custom drilldown search. One of them works just fine. But the other returns a blank page... by yuanliu SplunkTrust in Deployment Architecture 02-10-2020 0 2	0	2
How does the bucket system work in Splunk Cloud Hi Team, We were using Splunk Enterprise for last few years. And recently by May 2019 we have migrated all the data ... by anandhalagaras1 Contributor in Deployment Architecture 02-10-2020 0 6	0	6
About rentention specification of index After importing DBConect data, Although the rentention of the index is a day ago, It is kept for 5 days. Does splunk ... by nishida_tada_ca Loves-to-Learn Lots in Deployment Architecture 02-10-2020 0 1	0	1
Unable to add search peer from search head using distributed search :no route to host or connection refused Issue:Unable to add search peer from search head using distributed search :no route to host or connection refused err... by RK_sp1unk New Member in Deployment Architecture 02-09-2020 0 3	0	3
Can't see newly created indexes on search head in distributed search I have a single indexer and single search head with the indexer attached as a search peer and I created one index cal... by kjstogn Explorer in Deployment Architecture 02-08-2020 0 1	0	1
Multi-site Indexer rolling restart - indexer fails to restart/timeout Using Splunk 7.3.3, after I initiated a rolling restart from the cluster master (multi-site indexer cluster), the fi... by DEAD_BEEF Builder in Deployment Architecture 02-08-2020 1 6	1	6