×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
discenzadoe
Explorer
Member since: ‎01-08-2021
‎02-24-2023
Community Statistics
Posts 5
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎01-08-2021
View All

Re: Federated Search -How do I create lookup file ...

by in Getting Data In
‎09-04-2024 08:42 AM
‎09-04-2024 08:42 AM
You can use '| append [ | noop ]' as a workaround: | from federated <> | append [ | noop ] | outputlookup <>.csv   ... View more

Re: Migrating Splunk Enterprise Security from VM t...

by in Splunk Enterprise Security
‎04-18-2023 01:02 PM
‎04-18-2023 01:02 PM
Have you considered fresh ES install on the new physical server and migrate the data from your VM? ... View more

Re: What can I do about Splunk's Critical Deployme...

by SplunkTrust in Security
‎06-21-2022 08:50 AM
1 Karma
‎06-21-2022 08:50 AM
1 Karma
@discenzadoe - register from here to join us on Slack - splk.it/slack  ... View more

Re: Retiring old indexers

by SplunkTrust in Deployment Architecture
‎04-18-2022 07:57 AM
1 Karma
‎04-18-2022 07:57 AM
1 Karma
I read the OP as saying all five indexers are in a cluster. Since you mention force-freezing data I presume you don't need to keep the data on these indexers.  Is that right? If you don't want to keep the data then just remove the indexers from each SH's list of search peers then shut them down. If you do want to keep the data then the buckets will have to be converted into cluster format and copied to the other indexers.  Then each clustered indexer will have to be restarted to import the new buckets. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-24-2023 11:11 AM
Karma given to
View All