Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sushi
sushi
Explorer
Member since:
09-24-2021
09-14-2022
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-24-2021 |
Activity Feed
- Posted Re: I enabled Splunkforwarder firewall setting in Linux, now the Splunk 8080 port is not working on Installation. 11-05-2021 02:44 AM
- Posted Re: installation problem on Installation. 11-05-2021 02:39 AM
- Posted Re: Universal Forwarder sending two sets of Windows Security Logs to two different indexer on Getting Data In. 11-05-2021 01:11 AM
- Posted Re: Universal Forwarder sending two sets of Windows Security Logs to two different indexer on Getting Data In. 11-01-2021 06:17 PM
- Posted Re: Issues With DB Connect identities.conf on Search Head Cluster on Deployment Architecture. 11-01-2021 10:11 AM
- Posted Re: Issues With DB Connect identities.conf on Search Head Cluster on Deployment Architecture. 11-01-2021 09:53 AM
- Posted Re: Issues With DB Connect identities.conf on Search Head Cluster on Deployment Architecture. 11-01-2021 09:45 AM
Topics I've Started
No posts to display.
11-05-2021
02:44 AM
Please tell me your requirements. In usual, splunk don't use 8080 port.
... View more
11-05-2021
02:39 AM
Please tell me more information. - OS - Splunk version - How to install (tar?rpm?)
... View more
11-05-2021
01:11 AM
Umm...I think it is not possible if 2 indexers have different index name... You can only index on one indexer. I tried to set following conf. In default, testsourcetype is indexed to indexname1 on INDEXER1. INDEXER1 don't have indexname2. So, INDEXER1 cannot index events which forwarded to indexname2 on INDEXER2. If you have same indexname on INDEXER1 and INDEXER2, you can index on both indexers. # inputs.conf [monitor://testfile] sourcetype = testsourcetype index = indexname1 # props.conf [testsourcetype] TRANSFORMS-hogehoge = DataToForward,changeIndex # transforms.conf [DataToForward] REGEX= XYZ DEST_KEY = _TCP_ROUTING FORMAT = INDEXER2 [changeIndex] SOURCE_KEY = _TCP_ROUTING REGEX = INDEXER2 DEST_KEY = _MetaData:Index FORMAT = indexname2
... View more
11-01-2021
06:17 PM
Can you configure indexer2? If possible, you set nullqueue on indexer2. If not possible, I think you need to deploy HF between UF and indexers. The following posts may be helpful. https://community.splunk.com/t5/Getting-Data-In/Filtering-events-using-NullQueue/m-p/66392 Unfortunately, Bandwidth control is not possible for each indexer... UF have thruput in limits.conf, but this parameter should be global.
... View more
11-01-2021
10:11 AM
As document, you should configure following steps. 1. Install db connect apps on deployer. 2. Set up identities and connections for your database on deployer from web UI. 3. Copy the splunk_app_db_connect directory from $SPLUNK_HOME/etc/apps/ to the $SPLUNK_HOME/etc/shcluster/apps/ directory on the deployer. 4. Deploy the configuration bundle by running the splunk apply shcluster-bundle command on the deployer. Note that kerberos_client.conf, identity.dat cannot be replicated to other SHC nodes after it's been modified. You need to copy the files manually to other SHC nodes.
... View more
11-01-2021
09:53 AM
Have you configured db apps identities on deployer before deploy to shc?
... View more
11-01-2021
09:45 AM
Did you use deployer for installing db connect on search head clusters? If you didn't use, you may need to configure with deployer. First, install db connect on deployer and configure apps. Next, copy db connect dir to $SPLUNK_HOME/etc/shcluster/apps/ dir. Finally, deploy the configuration bundle by running the splunk apply and rolling restart shc. For details, please read splunk document. https://docs.splunk.com/Documentation/DBX/3.6.0/DeployDBX/Distributeddeployment#Deploy_DB_Connect_on_search_head_clusters
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-14-2022
04:44 AM
|
