About Vnarunart

Vnarunart · ‎11-08-2024

I appreciate your advice.

Vnarunart · ‎11-07-2024

Thank you very much for your comprehensive response. I have a follow-up question. In a scenario where we have two HF, is there a way to determine which HF the data originated from when searching in Splunk Cloud? Thank you for your advice and time.

Vnarunart · ‎11-07-2024

I would like to seek advice from experienced professionals. I want to add another heavy forwarder to my environment as a backup in case the primary one fails (on a different network and not necessarily active-active). * I have splunk cloud and 1 Heavy Forwarder, 1 Deployment server on premise. 1. If I copy a heavy forwarder (VM) from one vCenter to another, change the IP, and generate new credentials from Splunk Cloud, will it work immediately? (I want to preserve my existing configurations.) 2. I have a deployment server. Can I use it to configure two heavy forwarders? If so, what would be the implications? (Would there be data duplication, or is there a way to prioritize data? Or is there a better way I should do this? Please advise.

Vnarunart · ‎09-16-2024

As a Splunk newcomer, I need guidance on using Splunk effectively to send logs to a Disaster Recovery (DR) environment where I have one Heavy Forwarder (HF) and one Deployment Server (DS) on-premises. What steps should I take with my HF and DS to ensure smooth log ingestion into the DR Splunk Cloud instance? I have considered replicate vm ( HF and DS) as a possible solution, but I am still not sure about the best approach. Please advise on the following: - Are there any specific licensing requirements or restrictions for replicating Splunk instances? - What are the potential performance implications of replicating a Splunk VM, especially considering the data volume and real-time or near real-time requirements? - Are there any recommended best practices or configurations for replicating HF and DS VMs to a DR environment?" Thank for your help.

Vnarunart · ‎08-05-2024

I found that I need a Splunk cloud account (a member of Cloud Stack/Instances) to access the data, which the user I previously had did not have. However, I would like to thank everyone for their efforts in helping me this time. I’m grateful for your mentorship.

Vnarunart · ‎08-02-2024

Thanks for the advice, I appreciate it. I am working on Splunk account. In the scenario you mentioned about "pherhaps shared with the DS", I've checked directly on the DS under Settings > SYSTEM > Licensing and found the values to be default (expire: 2038). Is this the same license you're referring to? If not, could you please point me to the specific location or configuration file that references the LM I should be looking for? Thanks again!

Vnarunart · ‎07-31-2024

Hi, I need help as I'm new to Splunk and was assigned this role by a resigned administrator. I need to find out the expiration date of our Splunk Cloud license. I can't access the menu: Settings > System > Permissions (I've checked the assigned user's capabilities but there are no permissions for license_edit, license_read, license_tab, or license_view_warnings). Is it possible that there's a license manager somewhere on-premise since we're using Heavy Forwarder and Deployment Server? Please advise on what I can do if I can't contact the previous administrator. What information should I gather beforehand to be ready to open a Support Ticket? I apologize if I've misunderstood anything.

Posts	7
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎07-30-2024

Online Status	Offline
Date Last Visited	‎08-29-2025 06:16 AM

Can we clone the HF to another one?

HF and DS for DR

Splunk Cloud Licnese

Re: Can we clone the HF to another one?

Re: Can we clone the HF to another one?

Can we clone the HF to another one?

HF and DS for DR

Re: Splunk Cloud Licnese

Re: Splunk Cloud Licnese

Splunk Cloud Licnese

Are you a member of the Splunk Community?