Deployment Architecture

Community Activity

ERROR One of my 5 indexer is getting this error[MSE-SVSPLUNKI01] restricting search to internal indexes only (reason: [DISA... by SN1 Path Finder in Deployment Architecture 03-03-2025 0 8	0	8
Splunk Practical Deployment Lab I am a Splunk Enterprise Certified Admin who has an opportunity to advance to Splunk Architect. Im planning on taking... by shabamichae Path Finder in Deployment Architecture 03-03-2025 0 12	0	12
Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam In the practical Lab environment, how important is it to configure TLS on Splunk servers during the practical Lab. Do... by shabamichae Path Finder in Deployment Architecture 03-02-2025 0 3	0	3
List deployment client showing "no clients contacted the server" Hi,I have set up deployment server. When I checked splunkd_access.log , it shows successful phonehome connection from... by Poojitha Communicator in Deployment Architecture 02-28-2025 1 8	1	8
will server hardening (CIS redhat 9 level 1) break Splunk functionality? HiI have splunk servers (full deployment with index cluster, sh cluster) running on redhat 9.Now we want to harden th... by tdth Explorer in Deployment Architecture 02-23-2025 0 5	0	5
Search Head on Splunk Cloud Hi...I believe Splunk Cloud has 3 indexers, what about Search Heads? If there multiple Search Heads, does the ES app... by cpraz_ord Explorer in Deployment Architecture 02-21-2025 1 4	1	4
Offline Logging and oberservability - on permises right now we have a online soultion in the central observability otel collector send to splunk now im looking for the... by Skv Loves-to-Learn in Deployment Architecture 02-19-2025 0 0	0	0
Two syslog servers giving duplicate logs We have two syslog standalone servers (both are active) (one named as primary and the other is contingency) with UF i... by splunklearner Communicator in Deployment Architecture 02-17-2025 0 8	0	8
Roll back ES from 8.0 to 7.3 We have just upgraded to ES 8.0.2, and its is very bad or still in development stages and we want to roll back to 7.3... by Nawab Communicator in Deployment Architecture 02-16-2025 0 2	0	2
Using the same machine for deployment server and heavy forwarder I would like to know if it possible to use the same machine for both a Deployment Server and a Heavy Forwarder. If so... by anglewwb35 Explorer in Deployment Architecture 02-13-2025 0 5	0	5
What happens if the maximum size of Splunk index is exceeded Will the index size exceed the maximum to delete data or stop writing data by jiaminyun Path Finder in Deployment Architecture 02-10-2025 0 5	0	5
permission denied error while applying cluster bundle from cluster master to slave indexers I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/loc... by abhinav_maxonic Path Finder in Deployment Architecture 02-06-2025 0 5	0	5
v0.116.0 upgrade for EKS cluster gives webhook error Hi,I am trying to install Splunk version 0.116.0 in an EKS cluster but getting error in operator pod:webhook \minstru... by divyakhatnar Observer in Deployment Architecture 02-06-2025 0 0	0	0
Extracting fields from XML i have a sample xml which looks like this script_family>Amazon Linux Local Security Checks</script_family> <filename>... by arunkuriakose Explorer in Deployment Architecture 02-03-2025 0 2	0	2
Recommended sizing for deployment server? We have a deployment server as an instance of a search head. How many clients can a deployment server can handle? by rolltide Engager in Deployment Architecture 02-02-2025 0 7	0	7
DR Splunk indexer setup on AWS Cloud Hi Team, we are planning to build DR Splunk indexer on AWS Cloud.could you give the detailed instructions for creatin... by Rim-unix Engager in Deployment Architecture 01-30-2025 0 7	0	7
Automated rolling upgrade of a search head cluster I'm planning to upgrade a multi-site IDX & SHC environment to version 9.3 and i have question regarding the automated... by FRTS777 New Member in Deployment Architecture 01-29-2025 0 2	0	2
Adding existing standalone search heads to a cluster Hi TeamWe have a deployment with 3 standalone search heads . One of them have ES running on it. We are planning to in... by arunkuriakose Explorer in Deployment Architecture 01-28-2025 0 3	0	3
notable index replication in SH We have Search head cluster consisting of 3 Search heads. where Splunk enterprise security have notable index in the ... by AShwin1119 Explorer in Deployment Architecture 01-27-2025 0 2	0	2
Splunk ingest actions Hello, I'm using Splunk's ingest actions to aggregate logs and have created a destination and ruleset to forward copi... by Richy_s Path Finder in Deployment Architecture 01-24-2025 0 2	0	2
How to store logs to AWS S3 bucket with the hostname using Splunk Ingest actions We are utilizing Splunk Ingest actions to copy data to an S3 bucket. After reviewing various articles and conducting ... by Richy_s Path Finder in Deployment Architecture 01-24-2025 0 4	0	4
Optimizing indexing queue and question about the mechanism of rolling hot/warm/cold. Hello all, I want to ask about the mechanic of rolling bucket from hot to cold. In our indexes.conf we don't setup a ... by tungpx Explorer in Deployment Architecture 01-23-2025 0 2	0	2
Receving "Search auto-canceled" error while executing one month episod review. Receving "Search auto-canceled" error while executing one month episod review.Please let us know if any quick solutio... by KT1 Engager in Deployment Architecture 01-22-2025 0 2	0	2
How do I minimize the stored data of _introspection in a tiny cluster? At the moment, our tiny indexer has very little disk space and _introspection consumes roughly GB of storage a day, i... by danielbb Motivator in Deployment Architecture 01-21-2025 0 1	0	1
About cluster configuration Hello everyone, I have a question for you. In a single-site cluster, how can I configure license-manage to be a separ... by Lockie Engager in Deployment Architecture 01-20-2025 0 5	0	5