Hello, before the upgradation to splunk 9.x we have to move the actual instances of Splunk to new VMs with new OS version and additional resources  (CPU, RAM and disk space [indexers]): cluster SH: 3 nodes cluster indexers: 16 peer (2 sites). Migration for nodes like SHs, CM and Deploy are pretty clear, I have some doubt about the peers node. Probably we do the migration a peer at time, is it better to put peer offline or stop them ? in case is preferable to put them offline, is it possible to extend the restart period without time limit, for example 9 hours or more ? This is due to syncing the file system where indexes sits to the new VM. It also not clear if offline method rolls the bucket to warm from hot or must be done manually Thanks, ... View more

Hi everybody, i know this question was posted lot of time, but i'm not able to find help from the previous post. I have to index a csv file that every night is rotated/overwritten (same name, same folder) even if it has the same contents. In the inputs.conf i have set crcSalt = <SOURCE> unfortunately the newly files are not loaded, i'm missing additional setting ? Thanks G. ... View more

Hello, i have a big doubt about the RF behavior about single and multi site cluster. When a single site is used an hypothetical configuration: Replication Factor=2 is quite easy i have two copies of the same data in the site (originating + copy). And only one peer can goes down In a multi site (example two sites) if i understood, with:  -  site_replication_factor = origin:1,site1:1,site2:1,total:2 - there are two copies (originating site=1 other site=1). Only one peer can be down, is it in total or one at site ? -   site_replication_factor = origin:2,site1:1,site2:1,total:3 - there are three copies (originating site=2 other site=1)  Only two peer scan be down, is it in total or two at site ? Using   site_replication_factor = origin:1,site1:1,site2:1,total:2 means that if i loss the peer in originating site the SHs redirect query to the second site (SF=2) ? Thanks   ... View more

Hello, we have a cluster environment: - Search Head Cluster (3 nodes) - Indexers Cluster (4 sites) 10 nodes each actually is still with version 7.3.9 based on CentOS. We have to migrate the OS to Suse linux and at the same time upgrade to Splunk 8.2.6 ,  we want to prepare a parallel environment with the same number of nodes where to install the latest Splunk version. We also would like to use this new environment to migrate and fix the apps to be compatible with python, xml and jquery then start the env in production. We are struggling to find a way to migrate the indexes buckets (db_* and rb_*) and kvstore from old to new environment with less downtime and loss data, if it is possible what about the the GUID in buckets name. Thank you. ... View more