Deployment Architecture

Community Activity

	Using the same machine for deployment server and heavy forwarder I would like to know if it possible to use the same machine for both a Deployment Server and a Heavy Forwarder. If so... by anglewwb35 Explorer in Deployment Architecture 02-13-2025 0 5	0	5
	What happens if the maximum size of Splunk index is exceeded Will the index size exceed the maximum to delete data or stop writing data by jiaminyun Path Finder in Deployment Architecture 02-10-2025 0 5	0	5
	permission denied error while applying cluster bundle from cluster master to slave indexers I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/loc... by abhinav_maxonic Path Finder in Deployment Architecture 02-06-2025 0 5	0	5
	v0.116.0 upgrade for EKS cluster gives webhook error Hi,I am trying to install Splunk version 0.116.0 in an EKS cluster but getting error in operator pod:webhook \minstru... by divyakhatnar Observer in Deployment Architecture 02-06-2025 0 0	0	0
	Extracting fields from XML i have a sample xml which looks like this script_family>Amazon Linux Local Security Checks</script_family> <filename>... by arunkuriakose Explorer in Deployment Architecture 02-03-2025 0 2	0	2
	My servers class Agent allways in Pending status For some time now, the class server agents on my deployment server have been in Pending status, and yet the logs are ... by Elbald97 Explorer in Deployment Architecture 02-03-2025 0 0	0	0
	Recommended sizing for deployment server? We have a deployment server as an instance of a search head. How many clients can a deployment server can handle? by rolltide Engager in Deployment Architecture 02-02-2025 0 7	0	7
	DR Splunk indexer setup on AWS Cloud Hi Team, we are planning to build DR Splunk indexer on AWS Cloud.could you give the detailed instructions for creatin... by Rim-unix Engager in Deployment Architecture 01-30-2025 0 7	0	7
	Automated rolling upgrade of a search head cluster I'm planning to upgrade a multi-site IDX & SHC environment to version 9.3 and i have question regarding the automated... by FRTS777 New Member in Deployment Architecture 01-29-2025 0 2	0	2
	Adding existing standalone search heads to a cluster Hi TeamWe have a deployment with 3 standalone search heads . One of them have ES running on it. We are planning to in... by arunkuriakose Explorer in Deployment Architecture 01-28-2025 0 3	0	3
	notable index replication in SH We have Search head cluster consisting of 3 Search heads. where Splunk enterprise security have notable index in the ... by AShwin1119 Explorer in Deployment Architecture 01-27-2025 0 2	0	2
	Splunk ingest actions Hello, I'm using Splunk's ingest actions to aggregate logs and have created a destination and ruleset to forward copi... by Richy_s Path Finder in Deployment Architecture 01-24-2025 0 2	0	2
	How to store logs to AWS S3 bucket with the hostname using Splunk Ingest actions We are utilizing Splunk Ingest actions to copy data to an S3 bucket. After reviewing various articles and conducting ... by Richy_s Path Finder in Deployment Architecture 01-24-2025 0 4	0	4
	Optimizing indexing queue and question about the mechanism of rolling hot/warm/cold. Hello all, I want to ask about the mechanic of rolling bucket from hot to cold. In our indexes.conf we don't setup a ... by tungpx Explorer in Deployment Architecture 01-23-2025 0 2	0	2
	Receving "Search auto-canceled" error while executing one month episod review. Receving "Search auto-canceled" error while executing one month episod review.Please let us know if any quick solutio... by KT1 Engager in Deployment Architecture 01-22-2025 0 2	0	2
	How do I minimize the stored data of _introspection in a tiny cluster? At the moment, our tiny indexer has very little disk space and _introspection consumes roughly GB of storage a day, i... by danielbb Motivator in Deployment Architecture 01-21-2025 0 1	0	1
	About cluster configuration Hello everyone, I have a question for you. In a single-site cluster, how can I configure license-manage to be a separ... by Lockie Engager in Deployment Architecture 01-20-2025 0 5	0	5
	Hot/Warm/Cold bucket sizing- How do I set up my index.conf with as few possible per-index settings? After trying to get my head around the settings in indexes.conf to do data retention, and trying numerous different a... by jacauc Explorer in Deployment Architecture 01-19-2025 0 18	0	18
	How do I configure the HF to produce raw data and forward it to the indexer? It's not clear to me how indexAndForward works, the documentation says - "Set to 'true' to index all data locally, in... by danielbb Motivator in Deployment Architecture 01-19-2025 0 11	0	11
	Can i have just 2 search heads in a cluster looking to have 2 node search head cluster. so this means i need 3 servers, ie 2 members + 1 load balancer if i assi... by jiaqya Builder in Deployment Architecture 01-19-2025 0 10	0	10
	Splunk Cloud Data Input Hello Team,When an organization is having Hybrid deployment , so they using Splunk cloud service too, can data be se... by mohsplunking Path Finder in Deployment Architecture 01-17-2025 0 4	0	4
	All systems showing same IP Addresses in Forwarder Management My deployment server sits behind a load balancer. What I have noticed is that on the DS under Forwarder Management (... by DEADBEEF Path Finder in Deployment Architecture 01-16-2025 0 7	0	7
	Expand a single node to a cluster I'm trying to take a single node Splunk Enterprise system and expand it to a cluster with an additional search head a... by desmando Engager in Deployment Architecture 01-15-2025 0 8	0	8
	Why are there multiple results from the reporting search command? I am referencing the following to create a custom command.https://github.com/splunk/splunk-app-examples/tree/master/c... by HyunHo Engager in Deployment Architecture 01-15-2025 0 0	0	0
	How do I configure a small installation? I have an indexer, a search head, and a heavy forwarder for a small installation. How do I configure them to communic... by danielbb Motivator in Deployment Architecture 01-15-2025 0 5	0	5