Back to the Blog

Growing your Splunk Deployment

Posted by Anshu Rastogi on Tuesday, November 29, 2016 - 08:56 Operational Intelligence Splunk, Indexers, architecture, storage, Disks, Indexes.conf, Volume, Warm Data, Cold Data, Frozen Data, Offline, Migration

Intro

Growth.  It's important in so many aspects of our lives; from our careers, health, and relationships.  The famed motivational, self-help guru Tony Robbins says that beyond our basic needs, we need growth and giving back in order to truly be fulfilled.  In addition to adding to ourselves, sometimes growth requires us to rebuild a portion of ourselves.  Well, Splunk is no different.  In order for it to keep it's self-esteem high, it also needs to grow. In this blog post I wanted to cover a process to expand the number of indexers in an existing Splunk deployment while also...

read more

Monitoring Frozen Data Storage in Splunk

Posted by Anshu Rastogi on Tuesday, April 26, 2016 - 12:09 Operational Intelligence Splunk, Operational Intelligence, Big data, Script, Bash, Frozen Data, Archived Data, Scripted Input, Event Format

Frozen Wasteland

In this post, I'd like to visit the "Siberia" of Splunk data or frozen (archived) storage.  For all other types of data besides frozen, you can get insight on your Splunk data at the index and bucket level by using the "dbinspect" command or apps like "Fire Brigade."  However, because frozen data "lives" outside of the world of Splunk, there's no way to get insight on that data via Splunk.  Therefore, I will outline a solution for creating a scripted input to send metrics to Splunk which can then be used for reporting.

Create the...

read more
Stay In Touch