From Splunk Wiki
Documentation/Community subjects you'd like covered, a wishlist
- Have you been wondering what the best way is to do something in particular? Add your question to this page.
- Do you know the answer to a question someone has asked here? Make a page and tell us! Refer to Help:Editing and Help:Contribute if you need a little information first.
- When to use multiple indexes?
- When to use multiple instances on a single server?
- Security issues
- Moving data
- Server management
- How best to configure internal index logrolling?
- Best practices on adding to a summary index (timeframes, how much of an event, etc)
- Anonymization at search-time for particular users
- How to configure a proxy server to run in front of Splunk 4.x?
- Whats the best practice for upgrading in an enterprise environment?