I came across http://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html which seemed to describe perfectly the issue, but I've been unable to resolve - as far as I can see,...
What is the best practice for distributed data across 2 or more data-centers?
The objective is geographic redundancy. i.e. To survive the loss of 1 data-center.
The ideal would seem to be:
...
Can i share the output of a lookup command to one search head to another search head.
This is my Setup for this testing.
2 Search head, 1Cluster Master, and 1 Indexer
Search Heads are not...
Anyone using the Gemini KV Store Tools app (https://splunkbase.splunk.com/app/3536/)? If so, have you gotten the backup files retention to work? This app was recommended to me by Splunk Suppor...