Hi all, I have already read several interesting questions regarding this topic. I'd like to verify which approach is better. This wiki entry really helps: https://wiki.splunk.com/Community:HowIndexingWorks (topic 4. Detail Diagram - UF/LWF to Indexer) Goal: Routing of the data to the indexer layer / specific indexer (Indexer S) Issue: First forwarder can't communicate with the indexer directly (e.g. security etc.) I see now two options. Option A: I perform nothing with the data on the first (or more) forwarders until I reach the forwarder connected to the IX layer. -> so to speak pass through the data "raw" Option B: I cook the data on the first forwarder and on following forwarders I configure the next "queue" to be "typingQueue". Which should enable the routing capability of each following forwarder in the line. See following picture below for details: Which approach seems more feasible? Thank you in advance for any hints and remarks. Ps. Good input was found here: https://answers.splunk.com/answers/463643/does-cooked-data-from-a-hf-forwarder-automatically.html https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possible.html https://answers.splunk.com/answers/548367/definitions-of-the-route-keys-and-queuenames-for-s.html ... View more

Hi all, I'm trying to create a view according to "geo_us_states" for Germany. So far I was able to add/create the required "geospatial lookup". | inputlookup geo_us_states | inputlookup geo_germany What I currently don't understand within the geom command I can specify the following: | geom geo_us_states featureIdField="state" I checked the kml file and I couldn't detect an XML tag explaining what "state" is. Where does Splunk store/retrieve this information? Does any one know how I can apply it for my "Germany" purpose? Thank you in advance for any hints. ... View more

Hi all, after checking the documentation I am still not much wiser. I hope some of you have perhaps encountered the same issue and has found a solution. Following scenario: 2 sites both in europe defined as multisite Indexer Cluster Site 1 has the Cluster Master (CM) configured for the multisite IXC Site 2 is not maintained by you (external) a VM-Copy / snapshot etc. is not possible Site 1 (with the CM) of the two sites goes down or is unavailable to the other. Within the documentation it is specified that the CM should be setup immediately. If the site holding the master node fails, you lose the master's functionality. You must immediately start a new master on one of the remaining sites. Configure a stand-by master on at least one of the sites not hosting the current master. When the master site goes down, bring up a stand-by master on one of the remaining sites My questions: Why can't the master on site 2 be up and running? It has to be "brought" up... Re-configuring all peers to the new master takes time! How can this be avoided? If the "failover" CM is not known to the peers can it still be up? For references check following pages: https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Mastersitefailure https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Handlemasternodefailure https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Whathappenswhenamasternodegoesdown Thank you in advance for any hints or advices Kind regards Marco ... View more

Dear all, I am experiencing follwoing issue with Splunk 6.3.0 on linux machines: Before setting up a search head cluster we have had a script contained in our app within the "bin" folder to synchronise our lookup tables. After setting up the cluster this functionality is no longer required. I therefore removed the bin folder completely from our app and redistributed the app to our deployer. Then I applied the shcluster bundle via command to the sh. Now I see that on all search heads the old bin folder is still there... On the deployer I was able to verify that the folder no longer is there. I tought that maybe the command /opt/splunk/splunk/bin/splunk apply shcluster-bundle --answer-yes -target : -preserve-lookups true -auth : would also preserve old folder so I removed the parameter -preserve-lookups untortunately this didn't help either. Next I re-created the bin folder and only placing a README file there. Hopeing that this would overwritte the existing and no longer needed script on the search heads... I can still find the script on the search head instances. Is this a wanted feature or is this possibly an error in the distribution mechanism? Did someone experience the same? The only workaround I can think of now is to place a script within the apps for the sh instances to clean-up on the instance direclty and restarting those... Any other ideas or hints are greatly appreciated. ... View more