How to change thearchitecture from a single indexer to an indexercluster with indexer management? I need an overview of what configuration files need to be changed to change thearchitecture from s...
Hi, i have a problem with sending one index from indexercluster to another standalone Splunk instance. I have a 4 indexers, replication factor = 3 . How should I configure my cluster to send o...
...bandoning theindex_master for distributing theindexes.conf file and managing by myself the hand copy/edit ofthe various index files and rolling-restart oftheindexers?
Thanks,
Hi to everyone
I have a design, with four Splunk instances (two search head, and two indexers). I want an "indexercluster" (for replication and fault tolerance), and a "search head cluster" (f...
What is the difference between Cluster master and License master in a distributed Environment?
Any major differences and detailed explanation of both would be great.
Hello, everyone!
I have few questions about indexers cleaning:
- How it's performed in clustered architecture?
- Does it really needed? Do I correctly understand that frozen buckets delete automatically?
My current Splunk setup is a clusterof 3 indexers, one in each region. One Master, two Peers. With distributed search enabled between them. My next goal is to create High Availability Splunk e...
What's the recommended best practice to architect a Windows universal forwarder to an indexercluster? Is it better to forward all the Windows UF data to a VIP or just have them go straight to theindexers?
When one configures theindexercluster for SmartStore, does each indexer get its own S3 bucket? Or is there just one very large S3 bucket and all indexers write into the same S3 bucket (s...
Do we have any facility in the Splunk that we can achieve the High availability or Disaster recovery features in the Splunk. if yes, please share the documents for this. Your response will b...