Command passed under search of my Monitoring Console, I have all my 17 Indexers "Up" with the right site repartion. I dont see the decomissionned indexer who dont have any splunkd running. (Splunkd have been disabled). Thanks

What do you mean by "I integrated my UF with Splunk"? Also the usual questions. 1. Do you have _any_ events from this forwarder (especially forwarder's own logs in _internal index) in your Splunk? 2. Do you have connectivity from your UF to your receiving component(s)? Did you verify it manually? 3. Did you check your forwarder's logs ($SPLUNK_HOME/var/log/splunk/splunkd.log) for errors?

  splunk btool server list clustering | grep factor   Hi thanks, here is the output : etc/system/default/servers.conf >>> ack_factor = 0 etc/apps/MULTI_SITE_APP/local/server.conf >>> replication factor = 2 etc/apps/MULTI_SITE_APP/local/server.conf >>>search_factor = 2 etc/apps/MULTI_SITE_APP/local/server.conf >>>site_replication_factor = origin:1, site1:1, site2:1 total 2 etc/apps/MULTI_SITE_APP/local/server.conf >>>site_search_factor = origin:1, site1:1, site2:1 total 2 etc/system/default/server.conf >>> replication factor = 3 Regards,

Hi @SplunkySplunk , as @inventsekar said, these are thre ways to accelerate searches that runs in a different way and that re to use in different conditions. e.g. I used report acceleration when I had a dashboard with many real time searches, used by many users: I created an accelerated report that was visualized in the dashboard, in this way I had  a near real time dashboard used by many users, that runned only one search. Data Models, are the most efficient solution if you have to search only using predefined fields. Summary indexes are very useful when you want to reduce and structure your logs: e.. if you have the logs from a fireawll (that usually are very many and with many fields not always used!), you can reduce the logs and use the reducted logs for your searches, also on raw (reducted) logs. As me and @inventsekar said, it depends on what is your requirement. Ciao. Giuseppe

Two questions. In addition to comparison of host values for the purpose of exclusion, is there any other information you want to extract from sysmon_index?  I will assume no. Is presence in sysmon_index necessary and sufficient for exclusion?  I will assume yes. With these assumptions, you don't need stats.  The following subsearch should suffice: index=dhcp_source_index NOT [search index=sysmon_index | stats values(host) as host]

Possible solution would be a missing JRE installation. https://docs.splunk.com/Documentation/DBX/3.15.0/DeployDBX/Prerequisites#Java_Runtime_Environment_.28JRE.29_requirements Validate JRE is installed: java --version If nothing is returned, then on Ubuntu: sudo apt install default-jre Restart Splunk.