About shrutheen

shrutheen · ‎10-11-2022

I have 3 Search Heads and 3 Indexers with Replication Factor =1 and Search Factor=1. My requirement is to increase this to RF=3 and SF=2 Each indexer has around 800GB of data. Now if I increase the replication factor to 3 does it mean each indexer will end up with around 2.4TB of data post data rebalancing. And what would be the approximate data size in each indexer if RF is set to 2.

shrutheen · ‎09-24-2019

I was told by Splunk support that i was hitting SPL-160881 which was been partially resolved in 7.1.2 and later as well as ES 5.2.1 or later. However, we upgraded our setup to 7.1.6 and ES to 5.2.2 post which the duplicate occurrences have been very rare. As you know the issue is only with the backend code of incident review dashboard which displays duplicate notables, although they do not actually exist. Splunk support had made it clear even before we upgraded setup to 7.1.6 and ES to 5.2.2, that the issue was not completely fixed yet and may recur rarely.

shrutheen · ‎09-05-2019

I want to add a new Security Domain called "Email" in Enterprise Security (ES) App and later map it to notables. Right now "Threat", "Network", "Identity" are among a few that are available. Is there a way to achieve this ?

shrutheen · ‎03-14-2019

Same issue here. Just upgraded the ES Search head cluster to 7.1.3.1. However, the ES App version is 5.1.1and indexers are running with a lower version.

Posts	4
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-04-2018

Online Status	Offline
Date Last Visited	2 weeks ago

Increasing Replication and Search Factor

New Security Domain

Increasing Replication and Search Factor

Re: Splunk ES Duplicate of Notable Events displayi...

New Security Domain

Re: Splunk ES Duplicate of Notable Events displayi...