Deployment Architecture

Community Activity

Why is the deployer removing my search head apps after applying new apps? I have 3 search heads with an app foldername searchbaseapp. After using apply bundle on my deployer with my shclust... by paxsonkoh New Member in Deployment Architecture 11-04-2019 0 3	0	3
Can I reuse the license if I delete it from my current splunk server? I have installed a 50GB renewal license in wrong splunk server (Now the capacity is increased from 20 GB to 70GB) Can... by jigli New Member in Deployment Architecture 11-04-2019 0 1	0	1
Why is the deployment server unable to push apps to search head clusters? Hello !! I have created multiple apps under $SPLUNK_HOME/etc/shcluster/apps/ on the deployment server and checked th... by vgollapudi Communicator in Deployment Architecture 11-03-2019 0 18	0	18
How to replicate index to all the slave indexers? I have created a 5 node index cluster and its working fine. Now I created an index in master indexer and added some d... by vikcee Path Finder in Deployment Architecture 11-02-2019 1 1	1	1
Does not start splunk forwarder service I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts bu... by paola92 Explorer in Deployment Architecture 11-02-2019 0 2	0	2
Changing cold storage location for a single index Hi, Our default age for all events is 3 months, but there is a specific index that's needs events to still be availa... by justindett Path Finder in Deployment Architecture 11-01-2019 0 1	0	1
Splunk heavy forwarder data forwarding issue. WARN DateParserVerbose - The same timestamp has been used for 1000K consecutive times. If more than 200K events have the same timestamp, not all events may be retrieveable Hi, I'm facing issue with data forwarding to splunk. i'm not sure where data being dropped and its happening randoml... by manikandankasi Explorer in Deployment Architecture 11-01-2019 0 3	0	3
Can I use indexer discovery to forward search head cluster data to multi-site indexer cluster? We have a setup of 6 search head clusters connected to 2 multi-site indexer clusters, using Splunk v6.3.1. My objecti... by basanthp Path Finder in Deployment Architecture 10-31-2019 0 3	0	3
Unable to run "enable boot-start" as root user on RHEL 6.10 Hi, We installed/configured Splunk Universal forwarder 7.2.3 on hundreds of RHEL 6.10 in our environment and all of ... by batemanj New Member in Deployment Architecture 10-31-2019 0 10	0	10
Why am I getting Search Head Cluster Captain bootstrap error "Raft not initialized"? Hello all, I get the following error message when bootstraping my Search Head Cluster Captain: In handler 'shcluste... by chaker Contributor in Deployment Architecture 10-30-2019 3 7	3	7
how do you programmatically bump a search head? Is there a Splunkish way (via curl or rest or something) to do the equivalent of clicking the bump button on the _bum... by cphair Builder in Deployment Architecture 10-30-2019 0 5	0	5
Bundle Replication: Problem replicating config (bundle) to search peer Hi, I am very frequently getting below warning on UI: "Bundle Replication: Problem replicating config (bundle) to sea... by sarvesh_11 Communicator in Deployment Architecture 10-30-2019 1 3	1	3
Props and transforms stopped working on search heads I'm using the Splunk_TA_infoblox add-on in two ways: A modified version (with an added TRANSFORMS-1_branch_index) on... by ww9rivers Contributor in Deployment Architecture 10-29-2019 0 0	0	0
how to set the frozen path in Index Cluster? hi All, We have an index cluster(2 indexers) and we need to archive the Frozen buckets to a storage location. Do we ... by datamine Loves-to-Learn Lots in Deployment Architecture 10-29-2019 0 1	0	1
Determining if an index needs rebalance We recently worked with Pro Svcs to upgrade our Splunk Infrastructure and add two new search heads to the cluster. Th... by tsheets13 Communicator in Deployment Architecture 10-29-2019 0 5	0	5
Remote Site local searches when connection to main site is lost Hey guys, I'm pretty new to Splunk but I've been reading the documentation and trying to understand how I could imple... by michaelhc Explorer in Deployment Architecture 10-28-2019 1 4	1	4
What is the correct procedure to patch the OS and reboot host servers in an indexer clustering environment? We have 1 master and 3 peers all running RHEL 7. My question is, what is the correct procedure to patch the OS and r... by kornkid42 Explorer in Deployment Architecture 10-28-2019 3 5	3	5
At startup, Splunk is "Waiting for web server..." Will it time out and allow my server to boot? I broke web.conf and rebooted my linux box. Booted in AWS on splunk_marketplace_AMI_2018-09-28_14_12_30. SSHD hasn't ... by esalesapns2 Communicator in Deployment Architecture 10-28-2019 0 2	0	2
Is there a limit to the amount of servers a deployment server can black/whitelist? We are in the middle of trying to split the stream of data between splunk and a third party. In order to do this we a... by jcgever Explorer in Deployment Architecture 10-28-2019 0 3	0	3
How to put the search memory limit for a particular role? Hi, We are seeing high memory usage from certain set of people. We wanted to limit their search memory usage. Is it p... by saurabh0912 Path Finder in Deployment Architecture 10-27-2019 0 4	0	4
Splunk AMI in AWS (Beijing) Not working Hi Splunk Community, I'm trying to set up a splunk cluster in China (beijing) but the AMI (Splunk Enterprise ami ami... by ankugar New Member in Deployment Architecture 10-25-2019 0 0	0	0
Install Add-on for Unix and Linux I installed Splunk Add-on for Unix and linux on a single Splunk server environment for testing. However, each time I ... by ymzhangco New Member in Deployment Architecture 10-25-2019 0 4	0	4
Send Forwarder data from Splunk server as arguments Hello, We have a deployment App (modular Powershell) used on clients using the forwarder, I'm interested in passing ... by kuzkuz Explorer in Deployment Architecture 10-25-2019 0 2	0	2
How do I find corrupted buckets in a clustered environment? How do I find corrupted buckets in a clustered environment? by DerekB Splunk Employee in Deployment Architecture 10-24-2019 5 3	5	3
What should the replication and search factor be for a multi-site cluster? We have multi-site cluster, with four indexers on each site. I guess a replication factor of 2 is fine so each event ... by danielbb Motivator in Deployment Architecture 10-23-2019 0 4	0	4