Deployment Architecture

Discussions

Thread Info

Why are RF and SF not met?

Been having trouble with my indexers but everything is fine now and up. But now my RF and SF are still not been met. ...

by Path Finder in

Could I put all management functions(CM\Deployer\MC\LM) in one node？

I encountered the above error message when executing the $SPLUNK_HOME/bin/splunk validate cluster-bundle --check-rest...

by Explorer in

Bin bucket to start with event value

Hi All, I am using bin command to bucket all the event count based on a span of 200. The command I used is {my ...

by New Member in

Is it possible to enable or disable an application state in app.conf via deployment server?

Hi, I'm trying to disable a forwarder. For that, i'm changing the state to disabled in app.conf of collector class. I...

by Explorer in

Data Age vs Frozen Age on _internal index

It's my understanding that the default frozenTimePeriodInSecs is 6 years. I am confused about what this graph me...

by Path Finder in

Hitting limit: maximum number of concurrent auto-summarization - with 0 events and idle CPU

Hello Team, Pre staging environment (not production), a single server with 12 CPU + 24 GB or memory + raid0 nvme (2...

by Explorer in

Rebalancing script

To rebalance data, splunk only offers you to rebalance one single index or all the indexes but there is no option to ...

by Contributor in

500GB day license - HW needed and best practice "N" of Search Heads/indexers

Hi, if we upgrade license to 500GB. What is best practice Hardware architecture (CPU +RAM) based and number of "N" ...

by Communicator in

ansible-role-for-splunk framework install search head apps without cluster

We use the ansible-role-for-splunk framework found on GitHub: https://github.com/schneewe/ansible-role-for-splunk I...

by Engager in

Deploy App on a Search Head Cluster that contains a 3 folders with different files on members

Hi, I have created a custom app to implement ACME on search head cluster members with a script on bin folder that u...

by Explorer in

Can we use instances recommended by AWS compute optimizer for hosting Splunk in AWS

We have a few instances hosted in AWS that are extremely underutilized (single digit avg. cpu% for the 3 months. Th...

by Engager in

AWS Cloudwatch Logs to Splunk Ingestion

We have Splunk Heavy Forwarder running in a couple of different regions/accounts in AWS. We need to ingest the Clou...

by Engager in

import events to an index

Hi all, I deployed Splunk and enabled indexer clustering.Then I created an index in master-apps and it has been re...

by Path Finder in

Evaluation of storage and retention policy for cluster with 6 indexers and 'hundreds' of indexes

I am working on setting up a third party evaluation of a new network management and security monitoring installation ...

by New Member in

How can we recover the empty bucket in the var/lib folder after a Splunk system crash?

After a Splunk crash, we are finding that there are a number of emptybucket-hot_v1_xxx in the /var/lib/... folder. Al...

by Splunk Employee in

Licensing warning issued within 24 hour. Daily indexing volume limit exceeded.

I had an issue with storage. I was at another site for 2 weeks and we reached the max limit on our drive. I had to ...

by Loves-to-Learn in

HF to LM... is it one way or two way communication

Hi Splunkers... Assumptions... The HF we want to deploy.. it should be inside a DMZ network, the license master is...

by SplunkTrust in

Can multisite architecture be on different cloud environments with index replication?

If I have a multisite architecture with site A and site B, can they live on different cloud environments and still ha...

by Explorer in

Multi-Site Search Head Clustering

I understand that there are 2 approved architectures for multi site search head clustering. One, where each site has ...

by Explorer in

How to disable an index on a Cluster Master using REST API

Hello, I'm working with a Splunk cluster which has two slave peers and I need to disable an index on the Cluster Ma...

by New Member in

Isolated network

on isolated network/no internet access considered a transport network. Is there a way to still use add ons/ apps?

by Engager in

Ssl cert update

Hi Team ,In my Splunk Environment(Universal Forwarder) after updating SSL certificate I'm getting these error in Splu...

by Explorer in

Understanding Splunk Index Retention

Hi, and sorry if this question was already answered in any other thread. Thanks in advance for the help. I ha...

by Path Finder in

How to acknowledge the blacklist working or not ??

Hi Everyone, I've recently applied a blacklist file path regex to one of the apps inputs.conf in the serverclass on...

by Builder in

Error when sending windows events to splunk enterprise using powershell

I am trying to send events from my host machine to splunk using HEC. My Function: Invoke-RestMethod -Method Post ...

by New Member in

Get Updates on the Splunk Community!

Deployment Architecture

Discussions

Why are RF and SF not met?

Could I put all management functions(CM\Deployer\MC\LM) in one node？

Bin bucket to start with event value

Is it possible to enable or disable an application state in app.conf via deployment server?

Data Age vs Frozen Age on _internal index

Hitting limit: maximum number of concurrent auto-summarization - with 0 events and idle CPU

Rebalancing script

500GB day license - HW needed and best practice "N" of Search Heads/indexers

ansible-role-for-splunk framework install search head apps without cluster

Deploy App on a Search Head Cluster that contains a 3 folders with different files on members

Can we use instances recommended by AWS compute optimizer for hosting Splunk in AWS

AWS Cloudwatch Logs to Splunk Ingestion

import events to an index

Evaluation of storage and retention policy for cluster with 6 indexers and 'hundreds' of indexes

How can we recover the empty bucket in the var/lib folder after a Splunk system crash?

Licensing warning issued within 24 hour. Daily indexing volume limit exceeded.

HF to LM... is it one way or two way communication

Can multisite architecture be on different cloud environments with index replication?

Multi-Site Search Head Clustering

How to disable an index on a Cluster Master using REST API

Isolated network

Ssl cert update

Understanding Splunk Index Retention

How to acknowledge the blacklist working or not ??

Error when sending windows events to splunk enterprise using powershell

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Buttercup Games: Further Dashboarding Techniques (Part 5)

Customers Increasingly Choose Splunk for Observability

Offline Logging and oberservability - on permises

v0.116.0 upgrade for EKS cluster gives webhook err...

Does a props/transforms.conf Visio stencil exist?

My servers class Agent allways in Pending status

splunk_internal_telemetry:53 - Failed to send tele...