Hi @maede_yavari, you can have all the combination you like: single site or multi site Indexer Cluster stand alone Search Heads or Search Head Cluster. It dwepends on your requisite. For more infos see at https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf  but anyway engage a Certified Splunk Architect, my answer could be not sufficient to design your architecture (even if I'm a Certified Splunk Architect)! Ciao. Giuseppe

Hi @RSS_STT , please try this regex: (?<CI_V2>[^;]*);(?<CI_1>[^;\"]*);(?<CI_2>[^;\"]*);*(?<CI_3>[^;\"]*);*(?<CI_4>[^;\"]*);(?<CI_5>[^\"]*) that you can test at https://regex101.com/r/fndJqR/2 Ciao. Giuseppe

Hi Gcusello I can see the fields extracted in my datamodel And even if i use your search below I have no results | tstats count from datamodel=TEST where TEST.EventCode=100   I have only results heriteld fields like host, sourcetype, source    

Hi @maede_yavari, multisite architecture is required only if you need Disaster Recovery, otherwise, you can have a single site Indexer Cluster even if servers are in more than one site, even if a multisite cluster, setting Search Affinity, permits to your SHs to search in the local Indexers instead in all the Indexers. About Search Heads, a Search Head Cluster gives you knowledge objects replication, but you can also have stand alone SHs that access the Indexer Cluster. Anyway, don't use different clusters for different scopes, you will be crazy in logs separation and you'll surely have duplication of data because there are logs that must be used for more than one purpose. Data replication, can be configured and anyway grants you more safe in case of fault. Ciao. Giuseppe

Thanks for your reply. Splunk Architect recommend multi site architecture. but in the multi site architecture , I need to replicate data between sites to search them by search heads. also as I know we can not cluster search heads together in multi site architecture, because each site needs its own search head. Actually permission is not my concern. I want to decrease replication load and bandwidth usage by separate indexes.

Hi @mukhan1, ok, perform also the check I hinted to verify connection because telnet is important but it isn't the only check to perform: you could have an open connectin but you could not correctly configure outputs.conf in your Forwarder! let me know if you solved or if I can help you more. Ciao. Giuseppe P.S.: Karma Points are appreciated

Hi @maede_yavari, your architecture has no sense: you can have a very performant architecture with HA and you want to divide it, why? My hint is to engage a Certified Splunk Architect to design your architecture. You can separate accesses to data using different indexers in the Cluster giving different permissions top them. In this way you have a linear infrastructure with one Cluster mstr that manage all the Indexers and a Search Head (eventually clustered!) that access all the indexes in all the Indexers. Then you can separate access to data creating different roles to access security indexes or IT Operation indexes. Ciao. Giuseppe