How to change the architecture from a single indexer to an indexer cluster with indexer management? I need an overview of what configuration files need to be changed to change the architecture from s...
Hi
I am using the Forwarder Management to push out configs in the form of apps to the many forwarders in our infrastructure, but the new config is not applied.
My use case :
1. add-on a...
...below works, but how should I managechanges like this given the GUI limitation -- should I continue to edit the file directly (along with authentication.conf) going forward (and not use the G...
In the console, you can change the server roles of the instances in the Distributed Management Console manually. How can you do this using CLI commands or editing conf files? There is little to no d...
I am testing on using Splunk as a configurationmanagement tool so I can compare if there were any configurationchanges in my server (in this case, it is netapp filer add, modify, delete). I manage...
...y manually altering logging levels in .\etc\log.cfg. Does anyone have any experience managing this configuration as a deployment-app? I imagine it would be possible with deployment of a script to e...
...ossibility of a search head cluster due to OS incompatibility.
Q: Is it a requirement to migrate from standalone to distributed in this proposed configuration or am I better just having 3 standalone servers a...
I have a saved search that I modified in the Splunkweb Manager. I look at the same search in the savedsearch.conf file, and the changes are not registered there. I have performed a splunk restart f...
...o manage and seems impractical. See Upgrade the Splunk Add-on for UNIX and Linux.
This example has a setup page through which Splunk create the local configuration file. See Enable data and s...
...escribed in Configuration file precedence). For purposes of distribution and management simplicity, you might prefer to maintain just a single outputs.conf file, keeping it resident in an app."
You can't h...