I have this in server.conf on my searchheads:
[general]
pass4SymmKey = $$$$$$$$$$$$$$$$$
serverName = xxx-xxxxxxxx
site = site1
[clustering]
master_uri = https://xx.xx.xx.xx:8089
mode = search...
When I used to manually created indexes on prem, I would create a record in index.conf for Indexers and a separate one in indexes.conf for Searchheads. The documentation calls it a "SearchHead V...
Hello.
I'm running on RHEL 7 with 6.6.3 and an Indexer cluster (3 peers), and have 2 SearchHeads not in a SHC but connected induvidually to the index cluster.
I try to use KV store with a c...
I am going to create a multiple site cluster with Splunk 6.5 enterprise.
According to Splunk document of "Configure multisite indexer clusters withserver.conf". the "mode" under "[clustering]" s...
...m. Another config file, ~/etc/system/local/server.conf, is similar, withserverName, and the hashed pass4SymmKey and sslPassword being different. This is also using the .pem file as serverCert....
I'm working with data that is being sent from a universal forwarder (UF) on theserver. I do an INDEXED_EXTRACTION in the props.conf on the universal forwarder. When I search for the data on thesearch...
Hi guys,
I have an issue with my SearchHead cluster, the replication seems to not be working:
192.128.192.131 is theSearchHead1
192.128.192.136 is theSearchhead2
11-15-2014 12:42:3...
I'm trying to add another searchhead to my searchhead cluster. I'm receiving the following error when I try and bootstrap it.
[labsplunk-sh:/opt/sh2a/bin]$ ./splunk bootstrap shcluster-c...
So I have a device which sends it logs in CEF format via syslog. This is not an ArcSight connector. I have configured this device to send these logs to a syslog server which in turn writes them t...
Hi Experts,
I got a situation. I have 3 searchheads, 2 Indexers . I want to use one of the SH as a forwarder. So the idea is the 3rd SH reads data from TCP:3315 and sensd to both Indexers using a...