...ow dropping events.
Can I delete data from the _internal index on the clustered indexers to free some space? If so how do I safely do so?
Can I delete data from some non-interal indexers on the cluster...
Hi
I am running a heavy forwarder with HEC and it is sending datato 3 indexers. I am starting to read about waysto optimise this configuration, but I am not sure if I have all the s...
There a about 3 waysto set up outputs.conf and when you trying to setup forwarders.
you can either do a cli entry to add a forwarder server(and indexer) or you cand edit outputs .conf...
I had to rebuild my two slave indexers, but the master is still intact. However, I lost all data prior to the rebuild. Does the master not maintain a copy of the data? If not, had I rebuilt one, an...
In the process of trying toget Splunk App for Stream up and running in a distributed deployment using anindexcluster with 8 indexers set with repFactor = 5 and a single Stream App search-head. I h...
...ed by the cluster. I'm trying to figure out if there is a wayto craft a query from our search heads that will be directed to a specified indexer in the clusterand get it to return all data for a...
Situation: Indexercluster, dual site, replication factor=2
We have some old indexer servers to be moved to new servers. The disk is going to be the same and reused.
Can we just move the d...
Hi
I'm wondering if there is a wayto control on which indexers anindex resides
E.g. there are 5 Indexers (+all the other infrastructure like search head, cluster master etc)
3 of them s...
Hello My _internal index has grown past the 30 days of retention to 360+ days. This is due to future timestamps in the data keeping them from rolling. I want to just remove the entire index from t...