Hi We are planning to have indexer cluster environment. For testing, we currently have single indexer which has all of our application like "Splunk Addon for AWS" and others installed and all data is arriving as expected. I wanted to know, if we go for cluster environment where we have master node and multiple indexer node, in such case, do I need to install all the apps in all the indexers servers ? For example, do I need to install "Splunk Addon for AWS" app in all the indexers ? ... View more

Hi We are planning to automate the Splunk application installation and configuration process for quicker provisioning. In this scenario, our first step is to install the splunk app from CLI, for which we use this command: ./splunk install app https://splunkbase.splunk.com/app/1274/ However it gives an error saying: Error during app install: failed to extract app from /opt/splunk/var/run/87b95d9a426d8ebd.tar.gz to /opt/splunk/var/run/splunk/bundle_tmp/91801e5fc0eab8b4: No such file or directory Is there any way in which we can download the apps from splunkbase without having to manually download the tar file. ... View more

Hi We are installing splunk universal forwarder in all of our servers. It seems to be working fine, however there are multiple entries of each universal forwarder (fqdn and short name) For example: test.example.com (entry 1) test (entry2) I have verified that in the server.conf, the serverName entry is present. [general] serverName = test.example.com pass4SymmKey = TEST Can you share on what would be the right way to fix this issue ? ... View more