is it fixed? under which version is fixed? is there any technical documentation for that? Thanks   ... View more

Maybe one nice to know fact is, that when you are replacing UF with HF, then you start to generate more traffic  between those hosts, as HF add more metadata to all events. Basically if you don't need to do any data manipulation (like transforms) on intermediate forwarder it's better to use UF instead of HF. Just increase UF's throughput with limits.conf if the normal 256K is not enough. ... View more

For a deployment server to push the files to its peers, the app containing those files must lie under $SPLUNK_HOME/etc/deployment-apps. When you deploy an app, it gets installed under $SPLUNK_HONE/etc/apps. Since there's no direct way, you can try the following: 1. Have main DS push the config to the server behind firewall. 2. Write a simple bash script to to copy the app to the $SPLUNK_HOME/etc/deployment -apps directory in the secondary server. That script can be designed to check for the changes in the file and copy again to the deployment -apps, should you push an update from the main DS. You can do this by calculating hash of the app and keep checking it for changes (This is how Splunk does it too, they call it checksum to check for updates on DS for peers) 3. Have your secondary server push the changes to its peers for the first time/everytime there's a change in the app. You can configure this in the script itself to traverse to the /bin directory and run the command splunk reloaddeploy-server -class <<yourclassname>   Hope this helps, **Kindly consider accepting as answer/upvoting if it helped you** ... View more

Do you have a scheduled search that runs overnight and consumes a lot of memory? How much is "more than enough memory"? Once you've ruled out a rogue search and confirm the system meets the recommended hardware specs, consider opening a case with Splunk Support. ... View more

so if I remove the Indexer discovery then the pass4key will not matter ? ... View more

Hi @tam82, I created an app called TA_:Forwarder with the usual structure of each Splunk app (folders: bin, Default, local and metadata). Then in the default folder I added two files: outputs.conf and deploymentclient.conf. If you want, you can also use the Splunk Add-On Builder App (https://splunkbase.splunk.com/app/2962/) that's very useful. About the first installation I teached the customer specialists to copy the TA_Forwarder in $SPLUNK_HOME/apps on a machine and restart Splunk, in this way the client is connected with the Deployment Server Remember, before everything, to create a ServerClass containing all the clients to deploy the TA_Forwarder App, otherwise, at the first connection, the manually copied app id deleted by the DS. If you already have deploymentclient.conf and outputs.conf in system/local, you have to run a script to delete these files and restart Splunk after TA_Forwarders deployment. Ciao. Giuseppe ... View more