Hi, I have three indexers and it has 2 replication factor for now. I'm considering to add 1 more indexer and increase the current replication factor with 4. Is there any procedure to do that, such as changing Master with Maintain mode, edit server.conf and then restart? Thanks in advance. Joon ... View more

Hi Splunk forks, I would like to make sure if the following upgrade path is okay. We have ES 4.5.1 running on Splunk Enterprise 6.5.1 and the below is what I’m thinking. First, Upgrade to ES 4.7.4 Second. Upgrade to Splunk 7.0 Third. Upgrade to ES 5.0 Thanks in advance. Joon ... View more

Hi, I'm working on adding new data in CIM and putting tags in Communication and network with required fields. Of course, we have proper assets and other data types pull the info well. I also expect to view asset fields when searching for new data but none are shown. Is there any other way to have assets fields automatically? Tags: network and communication Fields: src_ip dest_ip dest_port src_port .., Thanks in advance. ... View more

Hi, It may be stupid question. I'm considering raid 10 with splunk index cluster. In this case, should I also need to configure index replication factors? Thanks, Joon ... View more

Hi, I'm designing SPLUNK AWS and thinking how long days we're able to store data within our budget. Looks like if we can take both types of storage, S3 and EBS together, by storing thawed data on s3 and remain data on EBS, I may have more retention periods. Does it make a sense? Thanks, Joon ... View more