You don't even need to tell Splunk that sites Alpha and Bravo exist. You can have every server at one physical site or servers across 20 physical sites - it makes no difference. You get to define the sites, and assign servers to sites, using any scheme that you want in Splunk clustering. In a cluster, every indexer must have a site specified so that it can replicate properly. This has to be right and affects the setting of site_replication_factor/site_search_factor (eg. origin:1, total:4). There should be no "site" with no indexers assigned. In other words, every site should have at least one indexer assigned to it. Every search head must have a site specified for the purpose of "search affinity." This allows the cluster master to direct the search head to the most appropriate indexers for searching. The specification of search head site has nothing to do with replication. Since you don't actually have indexers at sites Alpha and Bravo, I would specifically: Configure your cluster master and indexers as a four-site cluster. Pretend that Alpha and Bravo do not exist. For the search heads at Alpha, identify the closest (best-performing) index site. Assign the Alpha search heads to that site. Now the Alpha search heads will search the nearest site; if it is not available, the cluster master will redirect the search heads to a surviving site. Repeat step 2 for the Beta search heads. This solution does not require set indexing-ready on the cluster master (although that's not a bad practice anyway). It also allows you to pick the optimum site for search heads to search. It is less of a hack and better aligned with the way indexer clustering works in Splunk. ... View more

That should help: source="/tmp/tmp.log" | base64 field="secret" action="decode" | search secret="*127.0.0.1*" ... View more

The Enterprise Security app Deployment planning topic on Clustering has been updated to show support for multisite clustering. Please note that a single-site or multi-site cluster architecture can have one search head or search head pool with a running instance of the Splunk App for Enterprise Security. Any other search heads cannot run the Enterprise Security app. Thanks! ... View more

The TailingProcessor, which is 'responsible' for checking which files have been updated (or are unread), used to be a single-threaded process in v5 (don't know if that has changed). Unless I'm much mistaken, that probably means that it would handle the input files sequentially. However, if not all of those files are being updated (i.e. it's an archive of ooold files), you would only see this problem the first time you're indexing the files. Also, if it is an archive of old files that you DON'T want to be indexed, you could set the ignoreOlderThan parameter in inputs.conf or move the old files away to some other directory (don't put them in subdirectory, unless you also set recurse=false for that input. 🙂 Hope this helps a little, K ... View more

Thanks! i'll try IFX. i think this is what i need. ... View more

Did you ever find the answer? I'm having the same problem. ... View more

Gosh, sorry its almost two years later. If the indexer goes down, the forwarder would try the next one. SplunkTCP is reliable and uses TCP acks so if the connection goes down, Splunk UF's would just try the next one. Also, we've got customers that set the interval to 10 and even 5 seconds. The advantage there is that if you search across last 1 minute, the data resides on more than one indexer, and the map reduce works better/faster. Best, Kyle ... View more

Actually i believe you need to install the paloalto add-on instead of the app Splunk_TA_paloalto Now at version 6.1.1 i believe ... View more