due to the splunk couldn't aggregate logs I want to use arcsight smart connector, I think I should use splunk app for cef, is it correct? and what type of forwarder do I need to use?
if the volume of received logs are huge and we need to seprate logs on indexer without need to replicate, is it to possible to manage them with master node? and how can we define indexer qu antities?
Hi @sabaKhadivi
maxTotalDataSizeMB
and frozenTimePeriodInSecs
in indexes.confAll the best 🙂