Deployment Architecture

Community Activity

is there a way for Splunk forwarder to merge difference lines to one event? Hello, I just getting into Splunk and wondering if I can set the forwarder (maybe heavy forwarder) to merge differen... by avivbaru Engager in Deployment Architecture 08-01-2019 0 1	0	1
How do I configure the outputs.conf file to forward data from heavy forwarders to a group of load balanced indexers? I have a cluster with a search head, master node, 2 indexers, and a deployment server. I am able to get the cluster ... by thomas_forbes Communicator in Deployment Architecture 07-31-2019 2 5	2	5
Segfault errors on a indexer in cluster We have this issue very frequently which appeared to have started right after the last upgrade. Below kernel logs sho... by sylim_splunk Splunk Employee in Deployment Architecture 07-31-2019 1 3	1	3
Switch Cluster Master to new machine HI Friends, I have ClusterMaster, SH, Indexers, License Master clustered. I want to move cluster master from one VM... by pkumar9610 Explorer in Deployment Architecture 07-31-2019 1 2	1	2
Splunk Enterprise / Universal Forwarder version compatibility Hi There, I am planning to upgrade my Splunk Enterprise (currently 6.5.5) and Universal Forwarders (currently 6.3.3)... by fxyfrank_acn Explorer in Deployment Architecture 07-31-2019 0 4	0	4
distsearch.conf is overridden after updating through GUI , upon restarting splunk We've SH Cluster environment and are seeing the following error ; "Gave up waiting for the captain to establish a c... by nmohammed Builder in Deployment Architecture 07-31-2019 0 14	0	14
Use standalone Splunk as a search peer Hi I am doing a short term gig building dashboards in Splunk and I have a production standalone Splunk Enterprise sin... by thulasikrishnan Path Finder in Deployment Architecture 07-30-2019 0 5	0	5
Server availability reports Hello, I need to prepare a server availability chart depicting "uptime / downtime" represented on a line chart. Th... by saurabhkunte Path Finder in Deployment Architecture 07-30-2019 0 5	0	5
How to configure Load Balancing on Splunk Search Heads? Hi! So I set up a F5 Load Balancer and listed all of my Splunk search heads as pool members. Apparently the load bal... by agentsofshield Path Finder in Deployment Architecture 07-30-2019 1 6	1	6
How to load balance search head cluster using Netscaler? Hi, We want to Load balance search heads using Netscaler LB. Search head are setup using SSL. We are seeing handsha... by osubbu New Member in Deployment Architecture 07-30-2019 0 1	0	1
Which version of Splunk Forwarder works with Security Onion 64 bit? I am trying to find a version of the Linux Splunk forwarder that works with Security Onion - previously in the past S... by robnewman353 Explorer in Deployment Architecture 07-30-2019 0 1	0	1
Cluster Master Error or indexer error - Splunk 7.2.3 We started Splunk and while the messages were scrolling it stopped on the windows index. It just sits, no addition... by halbeisendv Path Finder in Deployment Architecture 07-30-2019 0 3	0	3
bin/bucket: Where does the window start? I need this to start as the first event. Hi, the bin command conveniently provides time slots. But where do they start? It seems always on the next fitting c... by afx Contributor in Deployment Architecture 07-30-2019 0 2	0	2
Why am I getting error "Application does not exist" when applying a shcluster-bundle via Deployer to a search head cluster? Hi All, We are trying to create an app for our monitoring purposes, but when I have tried to deploy this through our... by splunker9999 Path Finder in Deployment Architecture 07-29-2019 1 8	1	8
Print Monitoring Linux So we recently had a requirement to start monitoring Printers usage from our print server. So I was reviewing the i... by mwinchester New Member in Deployment Architecture 07-27-2019 0 1	0	1
Cluster Master failure - is there any scenario searching will be impacted other than a search peer going down? As in, hypothetical scenario If the CM goes down overnight and it takes forever (eg. 10h) for a standby CM to manual... by splunk_zen Builder in Deployment Architecture 07-26-2019 0 2	0	2
Can you update the Splunk manifest so that it will not throw warnings about it being modified? We had to change parts of Splunk that changed the manifest, and Splunk always complains that the manifest is differen... by klopez30 Explorer in Deployment Architecture 07-25-2019 2 3	2	3
Whats the best process for remediating issues related to buckets not searchable Hello We have many messages similar to: Search peer thisIndexer05 has the following message: Failed to make bucket ... by tkw03 Communicator in Deployment Architecture 07-25-2019 0 4	0	4
Cluster master in the cloud? Consider a two data centre environment with good connectivity between (sub 5ms latency and multiple 40mbps links) and... by jeremyhagand61 Communicator in Deployment Architecture 07-24-2019 0 1	0	1
Is it possible to Identify splunk forwarder location ? Hello, we have plenty of forwarders install at different machine/folders. Is there any way to list out all forwarder... by AKG1_old1 Builder in Deployment Architecture 07-24-2019 0 5	0	5
Forward Universal Forwarder through Heavy forwarder Hi guys Consider my Splunk implementation as follows : Syslog ----> Heavy Forwarder ---> Indexer It's ok when i f... by muhammadalavi19 Loves-to-Learn in Deployment Architecture 07-23-2019 0 1	0	1
Missing data after index restore I do not understand why, but I appear to have missing data. We have 4 indexers in our cluster and in our server.conf ... by swangertyler Path Finder in Deployment Architecture 07-23-2019 0 4	0	4
Is anyone using CI/CD to deploy Splunk apps? Hello, We are trying to achieve one-click deployments with Splunk applications. Our desired workflow is below: 1) w... by mugurelmargarit Explorer in Deployment Architecture 07-22-2019 1 15	1	15
help on bucket time using hello in the query below, I monitore events where the cpu used is > 80% But I want to monitore only events where the... by jip31 Motivator in Deployment Architecture 07-22-2019 0 9	0	9
how can a saved search owner be changed I have created certain searches which shows admin as owner. I want to assign it to another user as the report owner.... by vikram_m Path Finder in Deployment Architecture 07-21-2019 1 10	1	10