Hi there,
I am trying to configure my Splunk environment (1xSH, 2xIndexers (cluster), 1xClusterMaster) to use parallelization, as described in Parallelizationsettings.
While I understand t...
Hi Experts,
I have 8 server setup (2 indexers in cluster, 3 SH, 1 CM, 1 Deplyer,LM,1 DS) on splunk 6.5. This setup is migrating as the servers will be decommissioned. So I have to migrate e...
Hi,
I'm testing out some features in 6.3, and looking at increasing our search and index throughput. One of the settings in the doc is "batch_search_max_pipeline", and the doc says:
"C...
...o maintain? and
what is the impact of having two queues?
With reference to the above: Suppose we find out that setting multiple indexing queue is not working as expected, then what is the impact o...
...Would increasing the [queue=parsingQueue] and [queue=aggQueue] in system/local/server.conf help lowering the queue fill ratio? The current settings are the default 6MB for Parsing and 1MB for a...
...atamodel is held on the search head(I think) and more indexers will help to split the dispatch.localSearch - This is the theory??
What i dont know is do i need to set up a cluster index or a non cluster i...
Hi
I have been looking at this doc on Capacity Planning Manual
http://docs.splunk.com/Documentation/Splunk/7.1.0/Capacity/Summaryofperformancerecommendations
But i am not sure what to do, all...
heyyyy everyone, anyone run into this annoying message before?
we keep getting this after moving to a search head cluster
"The system is approaching the
maximum number of historical search...
I am trying to install 2 universal forwarders on a single Linux host.
I read a few articles and changed the httpport and mgmtHostPort in the web.conf file in $SPLUNK_HOME/etc/system/local.
I also...
...orwarders to send 2 times data to new indexers. But unfortunately, the replication factor will normalise it same across the rest of servers. So not sure, if this will provide benefit
- Parallelization...