Deployment Architecture

Discussions

Thread Info

Universal Forwarder is slow to manage large files

Hello, I use an Universal Forwarder to monitor syslog-ng logs. The logs are splited in 24 logs for one day (so 1 log ...

by Engager in

Can you disable the management port (8089) on clients via the Deployment Server?

We're looking to disable the management port (8089) on current and future clients. Can this be done from a policy or ...

by Path Finder in

RP / SF not OK after decomissionning 1 indexer - Multi site indexer clustering

Hi all, Im under Splunk Version 9.0.2. After decomissionning one indexer in a multi site clustering, I cant retriev...

by Path Finder in

Creating Indexes While Balancing Least Privilege and Search Efficiency for Security Service Providers

Hello, I'm am wondering how other security service providers have handled this issue or what is best practice To ...

by Explorer in

Props and transforms not working deployment server

Hi, UF etc/apps/remo/local placed the inputs,outputs,props and tranforms configuration files and search the da...

by Loves-to-Learn Everything in

Picking which logs to monitor

When monitoring Windows systems which logs do you find to give the best information for finding security events and t...

by Explorer in

How to detect duplicate GUIDs on forwarders?

There are a number of posts on how to fix duplicate GUIDs on FWDs (https://answers.splunk.com/answers/32368/duplicate...

by Contributor in

Splunk Search Head Captain Election

Hello. I have a question about the captain selection process. Let me ask you a question using the example below....

by Path Finder in

splunk offline --enforce-counts looks stuck after 3 days of the decommission on first indexer of a multi site cluster

Hi all, I'm actually have to decomission 6 indexers on a 9/9 multi site cluster of indexers. The command passed...

by Path Finder in

How to configure Splunk opentelemetry collector in kubernetes with an OTLP receiver

Hi, I'm new to Splunk and relatively inexperienced with DevOps topics. I have a Splunk Opentelemetry Collector deploy...

by New Member in

How to make a cluster take over the data of an indexer that just joined the cluster

Hello Everyone There is one index cluster, one search header, one management node, and three peers. The configurati...

by New Member in

Estimated date/release for end of support of Linux kernel 2.6

Hello, I see that Linux kernel 2.6 is deprecated since 1 year (on April 2018, with Splunk 7.1.0). https://docs.spl...

by Explorer in

Configure a dedicated server for all data replication

while configuring RF and SH, can we configure that only one server should be used for saving all copies of data and d...

by Path Finder in

Clarification on indexer and search head

I am aware of forwarder -> indexer -> search head. However, when reading about streaming commands, Splunk states "A d...

by Explorer in

REST API for local user not working through SHC load balancer URL

Hi all, I am trying to authenticate a user against REST API but when testing via CURL, it is failing when using LB ...

by Builder in

How to determine the Forwarder that is sending data to a particular Index? Not Indexer!

So I am troubleshooting missing data from hosts, I have the index name that is missing the data, and so I would like ...

by Engager in

Splunk frozen bucket storage - management

Hi, Does anyone out there use any archiving software to monitor, report and manage frozen bucket storage in an on-p...

by Explorer in

SP-CAAAP3M - Tenable incorrectly reporting my instance vulnerable to privilege escalation running as non-root

This started out as a question, but is now just an FYI. Similar to this post, this week I received a old vulnerabili...

by Explorer in

Data Summary

Hi,Were currently deploying our internal Splunk instance and were looking for a way to monitoring the data sources th...

by Engager in

The Add-Ons

Hello Splunkers, I have an Architecture related question if someone can help with it please. My Architecture is l...

by Explorer in

Linux AuditD logging Vs Legacy Var/log/*

Hello Splunkers, I need some help in understanding the difference between Auditd logging on Linux and the tradition...

by Explorer in

High Availablity Implementation-Cluster

Hi Team, In my project need to be implement High Availability servers in below Servers are using. Z1-->L4 -->...

by Loves-to-Learn Everything in

Syslog Connect

Hi,We initially deployed a heavy forwarder on-prem to collect data from our passive devices (syslogs, security device...

by Engager in

Adding New Search Head Peers to Search Head Deployer and New Indexers to Cluster Master

Hi all, We need to add a couple dozen new search head peers to search head deployer, as well as adding a couple doz...

by Engager in

Splunk Alerts generated through Service now incident..

Hi Team, In my requirement, if any splunk servers are got failed, need to be generated Services now incidents need ...

by Loves-to-Learn Everything in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Universal Forwarder is slow to manage large files

Can you disable the management port (8089) on clients via the Deployment Server?

RP / SF not OK after decomissionning 1 indexer - Multi site indexer clustering

Creating Indexes While Balancing Least Privilege and Search Efficiency for Security Service Providers

Props and transforms not working deployment server

Picking which logs to monitor

How to detect duplicate GUIDs on forwarders?

Splunk Search Head Captain Election

splunk offline --enforce-counts looks stuck after 3 days of the decommission on first indexer of a multi site cluster

How to configure Splunk opentelemetry collector in kubernetes with an OTLP receiver

How to make a cluster take over the data of an indexer that just joined the cluster

Estimated date/release for end of support of Linux kernel 2.6

Configure a dedicated server for all data replication

Clarification on indexer and search head

REST API for local user not working through SHC load balancer URL

How to determine the Forwarder that is sending data to a particular Index? Not Indexer!

Splunk frozen bucket storage - management

SP-CAAAP3M - Tenable incorrectly reporting my instance vulnerable to privilege escalation running as non-root

Data Summary

The Add-Ons

Linux AuditD logging Vs Legacy Var/log/*

High Availablity Implementation-Cluster

Syslog Connect

Adding New Search Head Peers to Search Head Deployer and New Indexers to Cluster Master

Splunk Alerts generated through Service now incident..

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

Improve Data Pipelines Using Splunk Data Management

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Splunk-Operator Indexer Cluster Access Issues

CMMC Version 2.0

Stream forwarder only works when running as root

Search Cluster Overwriting etc/system/local/inputs...

What it takes to replace SAS with Splunk on IBM Z ...