Deployment Architecture

Community Activity

Data rebalancing is not working Hi guys, We tried data rebalancing. But nothing happens. We are forwarding data from universal forwarder using clus... by sudhir7 Explorer in Deployment Architecture 01-21-2020 1 1	1	1
Enterprise Trial license: does it include clustering? We are using Enterprise Trial License in our test environment so we just want to know whether we are able to create m... by anandhalagarasa Path Finder in Deployment Architecture 01-21-2020 1 9	1	9
Adding a new indexer to the indexer cluster Can I please know the process of adding a new indexer to the indexer cluster ? Should the cluster be kept in mainte... by nawazns5038 Builder in Deployment Architecture 01-20-2020 1 6	1	6
How to extract time from bash_history # timestamp? I'm dealing with bash_history files in the following format. I would like to extract the timestamp and use that as th... by peterm30 Path Finder in Deployment Architecture 01-19-2020 0 13	0	13
external account unsuccessful attempts to authenticate to multiple hosts Any help figuring out how to design a query for this would be helpful. by jshael New Member in Deployment Architecture 01-19-2020 0 2	0	2
Listing all directories aka sources for unix server How can we check which directories are being indexed for Unix server in Splunk? by bsaujla131984 Path Finder in Deployment Architecture 01-18-2020 0 4	0	4
setup.xml not supported on search head cluster? I've built a modular alert with a setup.xml to create credentials on the storage/passwords endpoint and to store a se... by mmarkleybac Engager in Deployment Architecture 01-17-2020 0 2	0	2
Chronology of Splunk Deployment I need to build Splunk Distributed Environment, how should i configure the different components. I have License/Clust... by sarwshai Communicator in Deployment Architecture 01-17-2020 0 6	0	6
Max Value for bucket ID I haven't been able to find this in the docs. The bucket ID is the last number in the name of a bucket directory. For... by reed_kelly Contributor in Deployment Architecture 01-15-2020 5 5	5	5
What would be a proper order of operations when applying an OS patch on a SH cluster? In the last patch operation on our ITSI cluster of three SHs, we had syncing issues with the SHs. What can be a good ... by danielbb Motivator in Deployment Architecture 01-15-2020 0 4	0	4
Separating a scripted BASH input from the parent (Splunk) process in order to perform restart on Linux (Ubuntu) I am attempting to run a scheduled BASH scripted input on UF 7.2.x on Ubuntu 16 or later. The script does some prepa... by bkcarter Path Finder in Deployment Architecture 01-15-2020 0 2	0	2
Replication Bundle Manual Removal Side-effects on 6.5.4 We have been witnessing an intermittent failures of bundle reaping in Splunk search heads and indexers on 6.5.4 Splun... by songailj Loves-to-Learn in Deployment Architecture 01-15-2020 0 0	0	0
Indexed data till date with no access on license master. Hi All, I'm stuck in a situation where i believe i would need your help. I need to get total indexed data per index... by rupeshn Explorer in Deployment Architecture 01-14-2020 0 2	0	2
execute a saved search in sh cluster captain I have a python script. I have configured commands.conf accordingly. Now I want to execute it using saved search at ... by rrmavani Engager in Deployment Architecture 01-14-2020 0 0	0	0
Multi-site Architecture - How to index and forward to main repository - license implications. Hi All- I realize a variety of derivations to this question have been asked before but it is still either illogical o... by sail4lot Path Finder in Deployment Architecture 01-14-2020 0 6	0	6
failed to make bucket Hello, I have a cluster of indexers and a couple of SH to run my searches and recently i've been getting the followi... by lksridhar Explorer in Deployment Architecture 01-14-2020 0 2	0	2
Splunk configuration issue Greetings!! help me on the following questions: I would like to ask about Splunk configuration issue of not gettin... by pacifikn Communicator in Deployment Architecture 01-14-2020 0 3	0	3
The percentage of small buckets exceeded Hello guys, I checked the splunk answers but I can´t find a solution for my problem. I have an indexer cluster with ... by michel_wolf Path Finder in Deployment Architecture 01-13-2020 0 0	0	0
How to replicate data to the indexer and a syslog server Hello all, I have a doubt in my routing configuration. I'm using an HF and I configured an app to perform some routin... by fsaporito Explorer in Deployment Architecture 01-12-2020 0 5	0	5
Migration to smartstore I have 2 multisite clusters, how I migrate certain indexes from old cluster to new cluster, and configure smartstore ... by dvg06 Path Finder in Deployment Architecture 01-12-2020 1 0	1	0
Additional Search head apart from SH Cluster -Will it work? Hello all, I have Index cluster in and SH cluster in our environment. All of them are 7.x version. Now I want to add... by sahabhi606 Path Finder in Deployment Architecture 01-10-2020 0 2	0	2
Replicate data to other Index Cluster Hi Everyone. I do have experience on setting up a clustered environment but this request is new to me. Situation: T... by jadengoho Builder in Deployment Architecture 01-10-2020 0 3	0	3
How to permanently decommission the Search Head? I have 10 SH in my environment.(THEY ARE NOT under SEARCH HEAD CLUSTERING) but they are under my master's "list of pe... by muez Explorer in Deployment Architecture 01-10-2020 0 2	0	2
All Serverclasses getting reloaded after one of the serverclass is deleted. In my environment I had one serverclass in deployment server, which had neither any client nor app. I deleted this se... by abhirajpawar New Member in Deployment Architecture 01-09-2020 0 0	0	0
Frozen data replication I want to setup a script to delete frozen data that older than 36 months. If I run the script to delete data from one... by sudeshgaur New Member in Deployment Architecture 01-09-2020 0 4	0	4