Deployment Architecture

Discussions

Thread Info

How to set the indexes for a single HTTP event collector input in an indexer cluster?

I'm configuring what I believe is the first scenario here: http://dev.splunk.com/view/event-collector/SP-CAAAE73#scen...

by Communicator in

Why are there conflicting statements in documentation about KV store in Search Head Clustering?

There appears to be conflicting statements about this feature. First we find a potential warning in the docs abou...

by Explorer in

Why can't I get my Splunk Enterprise installation to work on Ubuntu?

Hi, I'm trying to install Splunk Enterprise on a Virtualbox VM running Ubuntu 16.04. I get the following error af...

by Engager in

How can index clusters and search head clusters interact with each other in Splunk Enterprise on AWS?

I am trying to learn Splunk and understand how to install Splunk enterprise on AWS. While reading through the docu...

by Engager in

Why do Splunkforwarder Processes Start Acrobat Reader?

Hi going through sysmon logs I noticed, that the splunkforwarder (version 6.6.3) starts AcroRd32.exe on Windows cl...

by Motivator in

Getting Volume Data for the deployment in Splunk MC

I am setting up Management Console in my Splunk env's and am wondering why I am unable to see volme stats on the depl...

by Builder in

How to predict for future when you have the model fitted??

hello friends I am storing my customer's devices logs in my index. each customer has many devices and each device ha...

by New Member in

Is it necessary to have index definitions in Cluster Master

Hi, I was checking some old splunk distributed environment. I found a comment in the indexes.conf.template that wa...

by Influencer in

Can Splunk Universal forwarder be used to delete logs from a particular server.(Log rotation/deletion)

e.g. I have a universal forwarder installed on a server on which an application is running. The purpose of the UF is ...

by New Member in

default.old directories in SHC

Hi, There are thousands of default.old.<date-time> directories under /opt/splunk/etc/apps/<app_name>/ There wa...

by Influencer in

Error encountered for display

this error message - [subsearch]: Could not find an index named "_blocksignature". is encountered when performing a s...

by New Member in

How can I add the index to the fieldsummary as an extra column?

If I do index=* | fieldsummary I get the fieldsummary of all indices. How can I add the index to the fieldsummary as...

by New Member in

How much Storage should I be considering?

Hello community, First of all thank you for taking the time to look at my question. I will be ingesting the follow...

by Explorer in

Data Rotation Configuration of indexes.conf

The problem I am facing is that my data is going from hot/warm bucket to frozen bucket directly. However, I want it t...

by New Member in

Client stopped indexing as hostname, can only be found by IP now.

We have had our splunk configured for about 2 years and not much has changed recently. All the sudden the other day w...

by Engager in

Using Universal forwarder to send data from files in a folder to Splunk Enterprise

Hi, I have no experience with Splunk, learning the ABCs of splunk so please be patient... I am configuring the univer...

by Path Finder in

Splunk index on a Windows log folder

New to Splunk please help... I have created an index in Splunk enterprise and added a monitor to the splunk univer...

by Path Finder in

forwarders restarting

Can anyone think of a reason that might cause all 32 of my Universal Forwarders to restart within a minute of 3:46 PM...

by Path Finder in

Archiving speed is very very slow

I tried to archive data by adding frozenTimePeriodInSecs and coldToFrozenDir settings for individual indexes in local...

by Explorer in

I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in deployment server or support case with splunk?

I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in ...

by New Member in

prevent specific syslog from routing to 3rd party vendor using UDP:514

Is it possible to prevent specific logs from routing to a 3rd party vendor? We have IPS system that is generating too...

by Engager in

Master server is not figuring in splunk_server list when searching in _internal

Hello Splunkers, I have a problem when I'm searching in _internal index from my master server. My architecture ...

by Path Finder in

Replicating/Copying files within Splunk SH Cluster members

Hello, We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app ...

by Path Finder in

Splunk archiving setting not working properly

I am testing the frozenTimePeriodInSecs setting, I have following default stanza in my indexes.conf file. [default...

by Explorer in

I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help

I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generati...

by New Member in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

How to set the indexes for a single HTTP event collector input in an indexer cluster?

Why are there conflicting statements in documentation about KV store in Search Head Clustering?

Why can't I get my Splunk Enterprise installation to work on Ubuntu?

How can index clusters and search head clusters interact with each other in Splunk Enterprise on AWS?

Why do Splunkforwarder Processes Start Acrobat Reader?

Getting Volume Data for the deployment in Splunk MC

How to predict for future when you have the model fitted??

Is it necessary to have index definitions in Cluster Master

Can Splunk Universal forwarder be used to delete logs from a particular server.(Log rotation/deletion)

default.old directories in SHC

Error encountered for display

How can I add the index to the fieldsummary as an extra column?

How much Storage should I be considering?

Data Rotation Configuration of indexes.conf

Client stopped indexing as hostname, can only be found by IP now.

Using Universal forwarder to send data from files in a folder to Splunk Enterprise

Splunk index on a Windows log folder

forwarders restarting

Archiving speed is very very slow

I have 16 clients sending data to forwarders and to splunk cloud how do I create a new index ? Should I create it in deployment server or support case with splunk?

prevent specific syslog from routing to 3rd party vendor using UDP:514

Master server is not figuring in splunk_server list when searching in _internal

Replicating/Copying files within Splunk SH Cluster members

Splunk archiving setting not working properly

I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help

Developer Spotlight with Paul Stout

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

Data-Driven Success: Splunk & Financial Services

How to store logs to AWS S3 bucket with the hostna...

Optimizing indexing queue and question about the m...

Setup Splunk on AWS Elastic Beanstalk

CMMC Version 2.0

Stream forwarder only works when running as root