Hi gesman, Unfortunately, there is no direct way to limit the memory usage of a forwarder. But you can achieve it, if you make sure that your inputs are as limited as possible, e.g., point at single files or small directories with a few files and no subdirectories. You can reduce some memory by: shrinking maxQueueSize in outputs.conf to maybe 100 KB (vs a default of 500 KB) Another thing you can do, is to tell OOM of your OS to be "nicer" to Splunk, even they don't recommend turning it off. http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html Regarding the auto-restart feature; How should this be handled by Splunk if it is killed by OOM? Create a agent-like wrapper script which checks if splunkd is running and if not, restart Splunk. Hope this helps ... cheers, MuS ... View more

Hi purva13, You cannot do it this way, but you can do it in a different way. You can assign prefix and suffix to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done. <form> <label>run search based on button</label> <fieldset submitButton="false" autoRun="true"> <input type="radio" token="field1" searchWhenChanged="true"> <label>what to search?</label> <prefix>sourcetype="</prefix> <suffix>"</suffix> <choice value="*">all</choice> <choice value="splunkd">splunkd</choice> <choice value="splunkd_access">splunkd_access</choice> <default>*</default> </input> </fieldset> <row> <panel> <title>Search being run: index=_internal $$field1$$</title> <event> <search> <query>index=_internal $field1$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> </event> </panel> </row> </form> Hope this helps and gets you started ... cheers, MuS ... View more

Hi RecoMark0, If you're talking about OS level username and/or password then the answers would be: It depends on how to add a search peer. If your using the UI; all you need is a Splunk user with admin role and its password and you are able to add a search peer using the method described in the docs here http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/Configuredistributedsearch#Use_Splunk_Web You would need an OS level user if your adding the search head via CLI commands to exchange the Splunk keys like described here http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/Configuredistributedsearch#Use_the_CLI Hope this helps ... cheers, MuS ... View more