Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About muszyngr
muszyngr
Observer
Member since:
03-05-2020
02-18-2021
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-05-2020 |
Activity Feed
- Posted Do Deployment servers need to be assigned to a site in a multisite environment? on Deployment Architecture. 02-17-2021 04:13 PM
- Posted Re: Forwarder not sending data to indexer on Getting Data In. 03-09-2020 04:20 PM
- Posted Re: Why am I getting error "No indexers have reported into this pool today" and my indexer is not indexing any data? on Getting Data In. 03-06-2020 01:25 PM
- Posted Re: Why am I getting error "No indexers have reported into this pool today" and my indexer is not indexing any data? on Getting Data In. 03-06-2020 07:27 AM
- Posted Re: How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 04:07 PM
- Posted Re: How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 09:49 AM
- Posted Re: How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 09:36 AM
- Posted How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 08:46 AM
- Tagged How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 08:46 AM
- Tagged How does a Splunk universal forwarder talk to an indexer? on All Apps and Add-ons. 03-05-2020 08:46 AM
Topics I've Started
02-17-2021
04:13 PM
we have a two site Splunk environment and we have two deployment servers do they need to be assigned to a specific site under the general stanza as well as the multisite set to true under the cluster stanza? Currently they are reporting this error: "The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute.'" [general]
site = site1 [clustering]
multisite = true
... View more
Labels
- Labels:
-
deployment server
03-09-2020
04:20 PM
ok, so what did it what fixed it? this is so frustrating finding unanswered threads, not your fault, just the Splunk Documentation is so lacking and here I am three years later with a very similar issue
... View more
03-06-2020
01:25 PM
running this CLI command did it although it added the same exact stuff to the server.conf that we had there manually
splunk edit licenser-localslave -master_uri 'https://master:port'
https://docs.splunk.com/Documentation/Splunk/latest/Admin/LicenserCLIcommands#Manage_license_slaves
... View more
03-06-2020
07:27 AM
so five years later and we are getting the same error with no clear answer / solution in sight
... View more
03-05-2020
04:07 PM
so I found our outputs.conf file on our Deployment servers! Does that even make sense, I thought it needs to live on the receivers aka our Indexers? The file does point to our Indexers though in this stanza
[tcpout:IndexClusterGroup]
server = Server1IP:9997, Server2IP:9997, etc.
autoLB = true
... View more
03-05-2020
09:49 AM
the link to the video you provided
"Anyway, I hint to see at […] https://www.splunk.com/en_us/training/videos/getting-data-in-to-splunk-enterprise-windows.html to better understand how to configure your Universal Forwarder to send data to Indexers."
was about Monitoring not Forwarding, just letting others know
... View more
03-05-2020
09:36 AM
thank you for your prompt reply, I will check out the links you provided
that's just it though we don't even have an outputs.conf under the local directory and the one in the default directory is the vanilla original one, what stanza in the outputs.conf would I find the Index cluster under?
When installing a Universal Forwarder from scratch as a clean install the wizard allows you to configure a Deployment server or an Index server it says one or the other is required but not both, hence my confusion, if we point the Forwarder at a Deployment server how does it know where to send the logs
... View more
03-05-2020
08:46 AM
Total newb here, so please be gentle. So we are on the Windows platform and have Splunk Universal Forwarder 8.0.2 installed on many Windows 10 workstations as well on a bunch of Windows Server 2012 R2 etc. I am aware of the C:\Program Files\SplunkUniversalForwarder\etc\system\local directory construct and how to modify files in here and not in the default location
My question is if in the deploymentclient.conf file all we have is the:
[target-broker:deploymentServer]
targetUri = OurDeploymentServer:8089
Defined, how are our logs getting to our cluster of Indexers. By the way everything is working fine as I joined this team after they built and configured our Splunk environment already, I am just trying to catch up and was upgrading the UniversalForwarders to the latest version, hence my question of how does the data get to the Indexers when all the Forwarders know about is the Deployment server.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-18-2021
02:19 PM
|
