We are setting up our first dedicated search head.   Need some info of the Knowledge bundle replication process. 1) what is the maxbundlesize units ?   the default 2048  - is this kb, MB etc... 2) does this replication process copy all the files from the ../apps ../users ../system  to the search peer ?  So that if you update a app on the search head it will automatically updated it on the search peer ?  3) what log does this process write to? 4) Is there a way to manually run this process, like from the command line or will simply restarting the splunk service kick it off? Thanks     ... View more

The requirements state that all cluster systems must run the same OS. Does this include the same OS version level of a particular OS? example: Running the same distro Linux OS on all systems but one could be version 12 vs 15 or simple different service pack level of the same major version. SP1 vs SP2 and so on. Would this be acceptable ? Or with Windows, running 2016 and 2019 together in the same cluster. Thanks ... View more

Is anyone having trouble with evenitid add-on working with Splunk_TA_windows add-on? The Windows logs are being parsed and in a nice readable format but eventid seems to be expecting something different than what is being parsed. I'm getting results that don't match what I believe eventid is expecting. example: On the EventSources dashboard the Event Sources panel returns nothing for Error - All - * in the imput fileds. But if do a manual search just based on Type I get the following types ( event_sources | stats count by Type) Computer OperatingSystem Processor Roles Site SiteLink Subnet This clearly doesn't seem to be what eventid is looking for. Any ideas on what could be happening ? ... View more

How do I modify marcos.conf to include multiple indexes ? Will it recognize wildcards in the index name? example: [event_sources] definition = (index="win*" OR source=*WinEventLog*) disabled = 0 ... View more

I'm trying to setup "Splunk Add-on for Unix and Linux" . I have install the add-on manually on a forwarder and i'm trying to go through the setup and I select the items I want to enable and save it. Then it just redisplays the same setup page. It won't go further and there is nothing else to select. what I'm I missing or doing wrong ? Is there a command line component I need to do ? Browser: chrome Thanks ... View more