Hi, Unfortunately I inherited a Splunk deployment where the previous admin co-located multiple roles to one Splunk host. The admin put Deployment Server, SHC Deployer, and M...
...n for Microsoft Windows" ("Splunk_TA_windows") in an inherited Splunk instance. The TA doesn't seem to be gathering any data, and produces errors such: ERROR ExecProcessor - message from ""C:\P...
I inherited a Splunk deployment and I trying to understand the config I see and what is referenced in the docs. The deployer app.conf lists "deployer_push_mode = default" and I am wondering i...
Hey everyone! I'm in the process of investigating a Splunk instance that I have inherited. I've got a decent handle on things, but I am seeing that the majority of our index is being eaten up by l...
Hello,
I have inherited a set of splunk servers, and three are search heads. Some of the apps on the search heads are installed directly. I would prefer to manage those apps f...
I am troubleshooting an inherited env whose core includes : 3 x SH, 2 x PN, 1 x MN, 1 x DS
I am seeing the following errors on both my PN's :
INFO DC:DeploymentClient - channel=t...
Hello,
I have inherited a Splunk Enterprise deployment with a mixed OS (Windows/Linux) environment. We are in the process of converting this to a full linux instance and want to leave the H...
Hi!
I've inherited an app which contains custom searches only (this isn't a Splunkbase app, but an "in house" app.) My users want to be able to delete searches, etc from the app, but they can't. I...
Due to an administrative decision, we have "inherited" an independent Splunk installation (as opposed to our "core" system). This system is at 9.0. Our existing system is at 8.2.4.&n...