Can you paste me an example of the universal forwarder inputs.conf for monitoring a directory and forwarding syslog on Linux systems please? ... View more

I was talking about a single Search Head, not a cluster SH. Thanks ... View more

Thank you very much. Can a multi-site cluster be deployed with only 1 Search head that search throuh both sites? Thanks again ... View more

The client told me that some of the devices sending events are F5 BigIp. And it is not possible to install Universal Forwarders in them. In that case how can I achieve HA? Is it possible to configure a Heavy Forwarder for sending events to one indexer and ONLY IF that indexer is down, start sendign the events to the other indexer? Thank you very much. ... View more

I am going to ask if I am allowed to install UF then. In that case, can I configure it to send events to 1 indexer and only if that indexer is down start sending automatically to the other? Thank you very much!! ... View more

Thanks. The problem is that I don't have UF and I probably won't be able to install any. How can I deal with it? Thanks again ... View more

Thanks for your reply. The client wants HA on indexing layer, not Search layer. So we are creating indexer cluster. And of possible Heavy Forwarder cluster Is it possible to cluster the HF? Thank you very much ... View more

At this moment there is no HF either. Data is transmitted directly to the standalone Splunk via syslog, monitoring files, network inputs Thanks again ... View more

Thank you. But as I told you I don't have any universal forwarder. And I won't be able to install any. Thanks again ... View more

Okok. So answering" why would I do that". It is because as the sources are in different datacenters, sources in datacenters A will send to hf in datacenter A which will send to indexer in datacenter A. Unless indexer A is down so IN THAT CASE the HF A should send to indexer in datacenter B. I am seeing that the point of failure still exists in the HF right? If a HF is down I will be loosing events. How can I solve it? Thank you very much ... View more

I may have understood wrong. The data sources have to send the events to all the peers in the cluster? Won't that increase the license usage? I thought that data sources send to only one indexer and then the peers replicate between themselves. ... View more

Another one: If I include a HF in each datacenter. And an indexer goes down. Can the HF automatically start sending the events to the indexer in the other Datacenter? In that way I won't loose events when an indexer goes down in a datacenter. Is that possible? Is it recommended? The problem about adding more indexers is that I will need to backup all of them increasing the cost of the backup. Thank you very much. ... View more

So if I include 3 indexers in the cluster, which is the Search Factor and Replication Factor recommendations? Thank's again. ... View more

Thank you! One last question. Is it or is it not recommended to use Heavy Forwarders in this scenario. I think about buffering, filtering maybe. What is the best practice? Thank you very much. ... View more

HA 5gb-7gb 0.5ms Events Filtering. I didn't understand what you said about: "Note that an indexer cluster with just two peers cannot remain in healthy state if you lose a single indexer, you need at least three indexers to maintain an RF=2/SF=2 cluster in healthy state during peer outage." Thank you very much ... View more

Thank you very much ... View more

Thank's for your answer. I've already read that document and it specifies different possible alternatives. I was wondering if someone who has experience with a similar enviroment that mine, can recommend me based on the experience. Thank's again ... View more

Thank you very much. I've been reading what you sent me and I think that the answers are: YES YES ? Is that correct? Thank's again. ... View more

Hi, Thank you very much for your response. I will not migrate the old data. It's the customer decision. What would be better from the following?: To keep that indexer for the old data only and create a cluster with 2 new indexers? (Is this possible?) In this case I would have the SH consuming from one cluster (with 2 members) and a separate indexer. or Include this indexer as one of the members of the cluster and create a new indexer as the second member? (Is this possible?) In this case the SH will be consuming only from the cluster (with 2 members). Thank's again. Regards. ... View more

Hi, thank's for your response. I don't have throttle enabled. The notifications are received (by email) correctly "for each result". My problem is that I can not list those triggered alerts "for each result in a report" because in the _audit index each alert is only logged once. I can neither use the alternative of "Log Event" action because the client is using Splunk 6.1.4 and that action doesn't exist in that version. They can not upgrade because they don't own the License Master which is in that version. Any other alternative? Thank's again. Regards ... View more