Has anybody tried using the IP Reputation App for Splunk Enterprise before? It works, but is very slow. Any body experience this before? I am trying to lookup approx 3000 IPs every 10 minutes. Honey pot API is not getting the response back to me fast enough. Is there a way to sync that honeypot threat data to local lookup table and do local lookups? Thanks in advance! ... View more

It seems using KV store from migrating from lookups seems to be very easy. Just outputlookup to a KV store stanza. But Is there an easy way to update a record, instead of just bulk reloading of a lookup table. For example, I would like to update a field for a record in KV store from the results from a Splunk search. ... View more

Is there a way to call 2 different data models in SPL to join them with stats? I have tried multisearch, but didn't work. like this : | multisearch [ | pivot. DM_1.... ] [ | pivot ..DM_2.... ] | stats xx by yy ... View more

Hey Splunk gurus~! Splunk with R, Anybody interested in Splunk - R integration? Or anybody ever worked on this? If yes, we like hear about your Splunk R integration stories~! Look forward to hear from you. Cheers~! ... View more

Hey experts, Anybody experienced with Splunk running on AIX? We have all kind of problems with a few customers’ sites where they are running Splunk on AIX as forwarders. This particular question is about Splunk process consuming excessive processing power up to 80% of the entire system with having any input setting or special settings. Just running the Splunk daemon just consumes too much CPU resource. Any suggestions? Thanks. ... View more

Hi Gurus~! We understand managing INDEXERs should be done by the replication master. But when there are so many indexers to manage, like 50+ indexers and 5+ replication master across 5 continent, it makes us curious if we can use deployment server to manage replication master so those masters can distrubute application. I am sure this is not a common challenge due to the size of the deployment, but technically what would be feasible. I would appreciate expert's recommendations. In order to simplify multi splunk cluster environment, ( like 5 masters, and 50+ indexers ) Only way to manage is just at each 5 replication cluster's master. Yes, those cluster masters can be controlled via deployment server so that they then deploly apps down to the indexers in cluster environment. Using Splunk deployment server is not a good idea. Rather recommend other deployment technology like puppet of chief. Appreciate experts feedback on above 3 choices. ... View more

Hey guys, This questions is to those who had a little in-depth splunk engineering experiences. I am trying to design a optimal architecture for our splunk installation. Here are my objective. Environment : On a well designed H/W, 16 Cores (Linux OS), CentOS, total approximately 4000 IOPS storage system Will a single Splunk instance be able to consume (well utilize) majority of CPU and 4000 IOPS of storage? in other words, In order to consume as much IOPS possible with a single SPLUNKD instance? Of course to maximize index volume + maximize search performance. Do you prefer multiple splunk instances per server vs. single instance per server? Pros and Cons. I hear mixed opinions as well as mixed performance test results. I appreciate any real life experiences anyone of you had running Splunk in a big scale deployments. Cheers~! ... View more

Hi gurus~! I am trying to manage multiple deployment clients on sames host. For example, I have 10 instances of splunk instances which I want to manage their each instances using deployment server. So the problem I have is that, the deployment server can not distinguish each instance to assign a different server class because everyone of those instances come from same host. I realize deployment server recognize mgmt port so those instances have same host but different mgmt port. Is it possible to create serverclass that applies host id + mgmt port as a paired of info for deployment server to distinguish different instances with different config on same host? Appreciate your time, Gurus~! ... View more

I realize that Splunk creates indexes for lookup tables. Can Splunk really create indexes to maximize lookup performance? How can we for splunk to index lookup tables large as in GB. So the lookup speed gets improved. Also when we overwrite a lookup csv file update it with a latest list in large size, can we make splunk to reforce in indexes for lookups manually? Thanks.! ... View more

Hey Splunkers, I am trying to join / lookup a large set of data to each other. For example , transaction data to 20 million customer info. so I have to lookup every transactions to 20 million customer info. I have tried many ways to tackle this but haven't found the best solutions to this. lookups didn't work because the customer info records sized up to 2 GB. In order for splunk to be a big data engine, this seems to be a limitation. I appreciate your expert advice. Cheers! ... View more

Any Gurus have experience with a large lookup table? For example my lookup table seems to be 3 GB worth of line that contains all the phone users. Which I am trying to lookup a user name with an id / phone number. I have to lookup so many records, because the table is too large. What is the suggested way to lookup a large number of records? Clyde772. ... View more

Hi gurus, What is the max concurrent search we can configure on an indexer? and what would be a suggested number of concurrent search on an indexer? What are some of the consideration for maximizing the number of concurrent search? CPU or memory? I appreciate experts with big splunk deployments. Thanks. ... View more