I want to deploy a multisite Splunk cluster in the Docker Swarm cluster. We have 2 datacenters in different cities with the VMWare VSphere where we used to create virtual machines and install Swarm into this VMs. But now I want to create more advanced setup using Docker Swarm. I'm planning to create geo-distributed Docker Swarm cluster with 3 master VMs and 5-10 worker nodes in both VSpheres. Inside that cluster I want to deploy multisite Docker Stack with following architecture: [site1] 1 splunk cluster master - main 2 splunk indexers 2 splunk searchheads 1 splunk searchhead captain 1 splunk deployer [site2] 1 splunk cluster master - backup 2 splunk indexers 2 splunk searchheads 1 splunk searchhead captain Is it good architecture for ingesting big amounts of data? Which Docker network type should I use? For storage I want to use Docker daemon's local storage driver on each of the Swarm VMs, is it good choice or not? ... View more

I have an issue with Splunk saved searches. When I'm using the Splunk web interface, I can see ALL of the saved searches in my web browser, edit them or run. But when I'm using Splunk SDK, I can't get some of the freshly created reports. I have about 70 saved search queries right now and 60 of them are working properly. But the remaining 10 are not visible at all from SDK. I am running SDK version 1.6.14 and my saved searches run under admin user. I have also tried to run a sample script that outputs all of the saved searches: https://github.com/splunk/splunk-sdk-python/blob/master/examples/saved_searches.py and it shows me a really big output with about 69k lines in which I don't see my new 10 saved searches. Any tips? ... View more