Deployment Architecture

Community Activity

Can I use indexer discovery to forward search head cluster data to multi-site indexer cluster? We have a setup of 6 search head clusters connected to 2 multi-site indexer clusters, using Splunk v6.3.1. My objecti... by basanthp Path Finder in Deployment Architecture 10-31-2019 0 3	0	3
Unable to run "enable boot-start" as root user on RHEL 6.10 Hi, We installed/configured Splunk Universal forwarder 7.2.3 on hundreds of RHEL 6.10 in our environment and all of ... by batemanj New Member in Deployment Architecture 10-31-2019 0 10	0	10
Why am I getting Search Head Cluster Captain bootstrap error "Raft not initialized"? Hello all, I get the following error message when bootstraping my Search Head Cluster Captain: In handler 'shcluste... by chaker Contributor in Deployment Architecture 10-30-2019 3 7	3	7
how do you programmatically bump a search head? Is there a Splunkish way (via curl or rest or something) to do the equivalent of clicking the bump button on the _bum... by cphair Builder in Deployment Architecture 10-30-2019 0 5	0	5
Bundle Replication: Problem replicating config (bundle) to search peer Hi, I am very frequently getting below warning on UI: "Bundle Replication: Problem replicating config (bundle) to sea... by sarvesh_11 Communicator in Deployment Architecture 10-30-2019 1 3	1	3
Props and transforms stopped working on search heads I'm using the Splunk_TA_infoblox add-on in two ways: A modified version (with an added TRANSFORMS-1_branch_index) on... by ww9rivers Contributor in Deployment Architecture 10-29-2019 0 0	0	0
how to set the frozen path in Index Cluster? hi All, We have an index cluster(2 indexers) and we need to archive the Frozen buckets to a storage location. Do we ... by datamine Loves-to-Learn Lots in Deployment Architecture 10-29-2019 0 1	0	1
Determining if an index needs rebalance We recently worked with Pro Svcs to upgrade our Splunk Infrastructure and add two new search heads to the cluster. Th... by tsheets13 Communicator in Deployment Architecture 10-29-2019 0 5	0	5
Remote Site local searches when connection to main site is lost Hey guys, I'm pretty new to Splunk but I've been reading the documentation and trying to understand how I could imple... by michaelhc Explorer in Deployment Architecture 10-28-2019 1 4	1	4
What is the correct procedure to patch the OS and reboot host servers in an indexer clustering environment? We have 1 master and 3 peers all running RHEL 7. My question is, what is the correct procedure to patch the OS and r... by kornkid42 Explorer in Deployment Architecture 10-28-2019 3 5	3	5
At startup, Splunk is "Waiting for web server..." Will it time out and allow my server to boot? I broke web.conf and rebooted my linux box. Booted in AWS on splunk_marketplace_AMI_2018-09-28_14_12_30. SSHD hasn't ... by esalesapns2 Communicator in Deployment Architecture 10-28-2019 0 2	0	2
Is there a limit to the amount of servers a deployment server can black/whitelist? We are in the middle of trying to split the stream of data between splunk and a third party. In order to do this we a... by jcgever Explorer in Deployment Architecture 10-28-2019 0 3	0	3
How to put the search memory limit for a particular role? Hi, We are seeing high memory usage from certain set of people. We wanted to limit their search memory usage. Is it p... by saurabh0912 Path Finder in Deployment Architecture 10-27-2019 0 4	0	4
Splunk AMI in AWS (Beijing) Not working Hi Splunk Community, I'm trying to set up a splunk cluster in China (beijing) but the AMI (Splunk Enterprise ami ami... by ankugar New Member in Deployment Architecture 10-25-2019 0 0	0	0
Install Add-on for Unix and Linux I installed Splunk Add-on for Unix and linux on a single Splunk server environment for testing. However, each time I ... by ymzhangco New Member in Deployment Architecture 10-25-2019 0 4	0	4
Send Forwarder data from Splunk server as arguments Hello, We have a deployment App (modular Powershell) used on clients using the forwarder, I'm interested in passing ... by kuzkuz Explorer in Deployment Architecture 10-25-2019 0 2	0	2
How do I find corrupted buckets in a clustered environment? How do I find corrupted buckets in a clustered environment? by DerekB Splunk Employee in Deployment Architecture 10-24-2019 5 3	5	3
What should the replication and search factor be for a multi-site cluster? We have multi-site cluster, with four indexers on each site. I guess a replication factor of 2 is fine so each event ... by danielbb Motivator in Deployment Architecture 10-23-2019 0 4	0	4
What do we need to back-up in a multi-site cluster? We have a multi-site cluster with four indexers on each site and replication factor is at 2. When we back it up, is i... by danielbb Motivator in Deployment Architecture 10-23-2019 0 3	0	3
Deployment server with load balancer seating in front of two HFs Hi - I'd like to know if there is any issues when I add a new F5 load balancer in front of two HFs receiving apps upd... by vnguyen46 Contributor in Deployment Architecture 10-22-2019 0 4	0	4
Simple Splunk Lab Sizing I have setup Splunk free on a Ubuntu server VM in my home lab. The VM is setup with a 100gb disc. I would like to co... by mlines333 New Member in Deployment Architecture 10-22-2019 0 2	0	2
Migrating an index configuration from a single instance to an indexer cluster I have a custom index defined in apps/search/local/indexes.conf that receives data pretty much continuously. In mig... by brettcave Builder in Deployment Architecture 10-22-2019 0 3	0	3
How to retrieve host names from forwarder management I have two host names under clients in Forwarder management. I need to export these host names to a excel or csv so t... by kavyamohan Explorer in Deployment Architecture 10-22-2019 0 3	0	3
How forwarder is sending data to indexers? Sudden error in 1 forwarder. Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to resta... by muizash Path Finder in Deployment Architecture 10-21-2019 0 3	0	3
maximum number of buckets in a multisite indexer cluster I have a million dollar question I have a customer with > 200 TB daily ingestion of data and they have a multisite cl... by epeeran Observer in Deployment Architecture 10-21-2019 0 0	0	0