How migrate dashboards of the Search App on a standalone dev Search Head to a...
Dear SPLUNK Community, I have one development Search Head and a Search Head Cluster in my cluster. I am using the default search app to create dashboards on a dev SH. I create dashboards with the admin...
View ArticleHow to remove an app from a search head cluster and cluster peers?
I wish to uninstall an app from my Search Head cluster and cluster peers. Is this the following the way to go about it? On each Search Head and peer cluster member: 1.Run the following command in CLI...
View ArticleIn Search Head Clustering, what splunkd.log entries will show when an...
I know I can run the following to get the current SHC captain, splunk show shcluster-status -auth : but for debugging, what text can I search for to see the sequence of the dynamic captain change over...
View ArticleBest practice for restoring a dashboard on a Search Head Cluster
I recently had to pull a dashboard raw XML file off of an archive. What is the process for actually putting it back in? I copied the file to the original directory ......
View ArticleAre there recommendations for upgrading a search head and indexer clustering...
Trying to work through building our first cluster. I really do not have any data that is that "important", but due to labor time to build it to this stage, am a bit hesitant to fire off a mass upgrade...
View ArticleHow can I design my search head and indexer clustering architecture?
Hi to everyone I have a design, with four Splunk instances (two search head, and two indexers). I want an "indexer cluster" (for replication and fault tolerance), and a "search head cluster" (for...
View ArticleIs KVStore supported in search head clustering?
I am trying to build a dashboard based on certain time series data for monthly and yearly trends. We have been using CSV inputlookup for that, but came to know they are not for storage. So was...
View ArticleWhy are new report accelerations showing "Summarization not started Updated:...
We're running a large Splunk cluster with search head clustering. We currently have 30 reports with acceleration turned on. I recently added a new report and turned on acceleration for the past 7 days....
View Article"Page not found" when trying to configure SAML on all search heads in cluster
When trying to configure SAML, going to "Access controls » Authentication method » SAML", I'm getting a "Page not found!" error. This happens on all three sh's in my cluster, and only for SAML...
View ArticleIs it possible to have different search head cluster member timezones?
Is it possible to have a search head cluster in which some of the members have a different time zone? Documentation only mentions accurate time ie via ntp but not actual local time zones. Say I have 5...
View ArticleIs there a limit to how many Search Heads can be part of a Cluster?
Is there a limit to how many Search Heads can be part of a Cluster? We have a fairly large deployment and I wanted to know if there is a max limit of the amount of SH's that can be part of any one...
View ArticleAfter intalling Splunk DB Connect 2.0.6 on our Search Head Cluster members,...
Looks like Splunk DB Connect 2.0.6 fixed the issues with the local execution of the scripts. Now I'm facing the following problems. I've installed DBXv2 on our Search Head Cluster members, built the...
View ArticleHow to deploy and configure the Monitoring of Java Virtual Machines for JMX...
We have recently moved from a standalone search head to a clustered environment with multiple search heads. I have not seen any documentation as to how this is configured and runs in a clustered...
View ArticleHow to delete old lookup table (CSV) files in a search head clustering...
How can one delete stale lookup files? Sometimes users output their data to a lookup table file to reference in another search and fail to remove the old lookup table file. This in turn causes the...
View ArticleAdding a new search head to an existing Search Head Cluster, if I want to add...
I am adding a new search head to the existing search head cluster. I want to add the same users to the new search head, from my LDAP. If I copy the authorize.conf & authorization.conf, will it...
View ArticleIf I have an existing search head cluster with a replication factor of 3,...
I need to configure new search heads to an existing search head cluster, currently with a replication factor of 3. When I add the new search heads, should I increase the replication factor? Please...
View ArticleI currently have a Deployer, Deployment Server, and Cluster Master on the...
In our current enterprise topology, we are running Splunk 6.2.1 clustered search heads and we have our utility instances (cluster master, deployer, deployment server) running on the same host as one of...
View ArticleAre there any issues with running a Search Head Cluster Deployer and a...
I'm wondering if there are any issues with running Deployer (for search head clustering) on the same instance as a multi-site Indexer cluster Master. I'd like to have a single instance run as the...
View ArticleHow to set up the Kafka Messaging Modular Input in a Splunk 6.2.4 search head...
I'm trying to get this set up, but I'm a little mixed up... the directions mention: Configuration *As this is a Modular Input , you can then configure your Kafka inputs via Manager->Data...
View ArticleIs the Splunk App for Web Analytics supported in a Search Head Cluster?
I just realized that a different app that I was struggling with specifically states that it is unsupported on a search head cluster, and before I spend any more cycles looking into oddness on the web...
View Article