@ckunath, You'll need to find out what the inputs.conf file looks like on the actual forwarder so that you know what to put into the deployment app you'll create. Here's the basics: http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Aboutdeploymentserver You'll tell the forwarder to look to the main instance using this splunk set deploy-poll command. http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Configuredeploymentclients Next, you'll create a deployment app that has an inputs.conf that you want the forwarder to follow. http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Createdeploymentapps And finally, you'll assign the app you created with the inputs.conf to the server class you created that includes the forwarder you mentioned. http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Definedeploymentclasses ... View more

@x05311, Check your license usage, which is something you'll want to keep an eye on with only 500MB/day. You can do this by going to Settings > Licensing > Usage Report. Check current and previous 30 days. If you've gone over your license 3 times in 1 month, you'll be unable to search until the next month. Splunk will continue ingesting data, but you won't be able to search it. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). If you ARE going over your license, you'll need to decrease inputs so that you're not in violation for 30 days. https://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Aboutlicenseviolations ... View more

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given. Global Roles are the best way to achieve this. ... View more

As long as when you set up homePath=volume:hot_warm/indexname/db/ in each indexes.conf for each index, then yes. homePath is a required value, so that should be easy. All you've done so far is tell Splunk that there ARE volumes...you haven't yet told an index to use them. ... View more