Hi, Unfortunately I inherited a Splunk deployment where the previous admin co-located multiple roles to one Splunk host. The admin put Deployment Server, SHC Deployer, and M...
...n for Microsoft Windows" ("Splunk_TA_windows") in an inherited Splunk instance. The TA doesn't seem to be gathering any data, and produces errors such: ERROR ExecProcessor - message from ""C:\P...
I am troubleshooting an inherited env whose core includes : 3 x SH, 2 x PN, 1 x MN, 1 x DS
I am seeing the following errors on both my PN's :
INFO DC:DeploymentClient - channel=t...
Hey everyone! I'm in the process of investigating a Splunk instance that I have inherited. I've got a decent handle on things, but I am seeing that the majority of our index is being eaten up by l...
I inherited a Splunk deployment and I trying to understand the config I see and what is referenced in the docs. The deployer app.conf lists "deployer_push_mode = default" and I am wondering i...
Hi!
I've inherited an app which contains custom searches only (this isn't a Splunkbase app, but an "in house" app.) My users want to be able to delete searches, etc from the app, but they can't. I...
Hello,
I have inherited a Splunk Enterprise deployment with a mixed OS (Windows/Linux) environment. We are in the process of converting this to a full linux instance and want to leave the H...
Hello,
I have inherited a set of splunk servers, and three are search heads. Some of the apps on the search heads are installed directly. I would prefer to manage those apps f...
I have inherited an deployment that has multiple environments: PROD, FTI, and oldFTI. I am needing to search from FTI to both prod and oldFTI, but the search can not be done the other way. Can s...