Hi there, our current Splunk Installation contains a indexer cluster with 2 nodes and 1 searchhead which also has the cluster master role, License role and deployment role included. I now added two new indexer peers to the existing cluster. So for the moment we have 4 indexer nodes in production. The main goal should be to leave only the 2 new indexers up and running. I have read in another thread that indexed data could not replicated to the new servers, so I need to wait until the retention period is reached. So far no Problem but I have a few questions about the current setup: - Do I have to change the Replication Factor /  Search Factor? The current setting is RF=2 / SF=2 - We created a couple of Server classes in our deployment server, each server class has it's own outputs.conf file, where I defined the tcpout through only the old indexer. Should I have to change that to the new indexers, so all the new data will directly go through this indexers? - Are there any other configuration files to modify to make sure new data will only go to the new indexers? - At the cluster overview webpage, I see that all indexers are searchable (4). Will Splunk searchhead automatically detect where to search for events?   At the splunk documentation I couldn't find much information about this topic/situation. So any information would be helpful. Thanks.   ... View more

Hi there, maybe a simple question for the pros. I have installed on different linux servers the UF to get logs and events. I noticed on this servers that splunk is running with 40 processes (splunkd -p 8089 start) at the same time. Is this a normal behavior? Can a reduce the amount of running processes? I'm using version 7.0.0 for the UF and the IDX. Thanks! ... View more

Hi there, I'm using Splunk 7.0.0 with an cluster setup for our indexer and a dedicated syslog server where also snmp traps are collected. This Server has a universal forwarder installed. For the first SNMP input configuration it works like a charm but now I try to get another one working but it doesn't work. The configuration looks like this: # SNMP Traps from Application1 [snmp://APPLICATION1-TRAP] communitystring = STRING1 do_bulk_get = 0 do_get_subtree = 0 index = temp ipv6 = 0 mib_names = APPLICATION1mibFILE response_handler = snmp_mode = traps snmp_version = 2C sourcetype = SNMP split_bulk_output = 0 trap_host = 192.168.1.39 trap_port = 8162 trap_rdns = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol # SNMP Traps from Application2 [snmp://APPLICATION2-TRAP] communitystring = STRING2 do_bulk_get = 0 do_get_subtree = 0 index = test ipv6 = 0 mib_names = APPLICATION2mibFILE response_handler = ResponseHandlerApp1 snmp_mode = traps snmp_version = 2C sourcetype = SNMP split_bulk_output = 0 trap_host = 192.168.1.39 trap_port = 8162 trap_rdns = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol disabled = 0 If I restart the splunk forwarder to activate the configuration changes there are no error messages/warnings regarding the SNMP Module in there. But as soon as the first trap from the second application arrives on the server, it will generate error messages. It looks like the splunk forwarder can not make a difference between the different community strings. He always tries to use the APPLICATION1. No matter if the string is equal or not with the configuration. Does someone has implemented more than one SNMP input with the SNMP Modular Input AddOn and differnt community strings and differnt indexes? It should be possible to configure more than one SNMP Input, isn't it? Many thanks [edit] I read the Developer Blog again, and found out that for the Trap listener part, you can only set the listener port and the listener host. So it Looks like all other stuff in the configuration (inputs.conf) is only for the active polling section. Then you have to configure everything else with the props.conf and transforms.conf. But the configuration of the MIB names will be used because it will translate the OID to readable names. Summary: You have to check if the SNMP Service from your Operating System will accept traps with different community strings. You have to configure all the needed MIB files into the inputs.conf file. Maybe you have to confert special MIB files first into *.py files. You have to setup a propper configuration in your props.conf and transforms.conf files. If that is done, the SNMP traps of the different sources will be indexed as you want. ... View more