About Jordan54

deepashri_123 · ‎02-26-2018

Hey Jordan54, You need to plan your architecture as per your requirements. Points to consider: 1. Replication factor and Search factor, your indexer sizing will differ accordingly. 2. Replication to be only across site or within site as well. 3. Data indexing will be load balanced across cluster irrespective of site or in the particular site. Refer the docs below: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisitearchitecture http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Multisiteclusters

gcusello · ‎09-26-2017

Hi Jordan54 You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist. after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled). Bye. Giuseppe

sbbadri · ‎07-28-2017

cool. Glad it worked, Please vote or accept the answer

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-08-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

In multisite Clustering, do both sites need to hav...

Why are some Windows Security events not logging i...

Trying to blacklist event code with accesses

Re: In multisite Clustering, do both sites need to...

Re: Why are some Windows Security events not loggi...

Re: Trying to blacklist event code with accesses

Join the Conversation