we are using iplocation command  i see that the GeoLite2-City.mmdb file is since 2019  [splunk@ilissplsh01 bin]$ ll /opt/splunk/share/GeoLite2-City.mmdb -r--r--r-- 1 splunk splunk 60695934 Dec 18 2019 /opt/splunk/share/GeoLite2-City.mmdb [splunk@ilissplsh01 bin]$   I have downloaded the file from https://www.maxmind.com/en/accounts/532070/geoip/downloads   also I see that there is Geolocation Lookup for Splunk APP (https://splunkbase.splunk.com/app/4102/#/overview) to allow iplocation    what is the recommended way to work with the command  ?   thanks  ... View more

Hi we are using Splunk 7.3.4 , wanted to confirm the data indexed is not encrypted by default  ... View more

We would like to start working on Google integration with Splunk  is there any APP available with Dashboards and Reports we can install  ? I think we are going to use Splunk_TA_google-cloudplatform to integrate the data  ... View more

We have the following architecture 1 SearchHead 1 Cluster Master 8 Indexers  1 deployment server   I am now added 2 new indexers , I see its syncing but very slow  [splunk@ilissplidx10 local]$ cat server.conf [general] parallelIngestionPipelines=2 [queue=typingQueue] maxSize = 20MB [queue=indexQueue] maxSize = 30MB [queue=aggQueue] maxSize = 30MB [queue=parsingQueue] maxSize = 30MB [clustering] cxn_timeout = 600 send_timeout = 600 rcv_timeout = 600 heartbeat_period = 10 [kvstore] disabled = true [splunk@ilissplidx10 local]$ cat limits.conf [default] max_mem_usage_mb = 600 # [search] #dispatch_dir_warning_size = 3500 base_max_searches = 60 # # ERROR: Events may not be returned in sub-second order due to memory pressure. max_rawsize_perchunk = 200000000 # [pdf] max_rows_per_table = 10000 # [scheduler] max_searches_perc = 100 # [join] subsearch_maxout = 500000 # [realtime] indexed_realtime_use_by_default = true [splunk@ilissplidx10 local]$ cat distsearch.conf [distributedSearch] statusTimeout = 20 [splunk@ilissplidx10 local]$ ... View more