You absolutely can migrate your indexers to a cluster. You'll want to enable them as cluster peers. But first read this topic for a few issues that you should take into account when you do so: http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment ... View more

Not necessarily. It depends on your search factor as well. With a replication factor of 3 and a search factor of 2, you're storing just two complete copies of your data. For the third copy, you're storing only the rawdata file, reducing the size of that third copy by a significant amount. For more details, including examples, see this subtopic on determining your storage requirements: http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Systemrequirements#Determine_your_storage_requirements ... View more

Replicated data does not count against your license. For details on licensing and clusters, look here: http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Systemrequirements ... View more

See this topic in the docs for information on the "rename-source" parameter: http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI ... View more

The other benefit is just the increased efficiency obtained by not having to replicate knowledge bundles across the set of indexers with each new search. For more information, see: http://www.splunk.com/base/Documentation/latest/Deploy/Mounttheknowledgebundle ... View more

From the online documentation: "The universal forwarder is backwards compatible with older Splunk indexers. You can forward data to any Splunk indexers, version 3.4.14 or above. " See: http://www.splunk.com/base/Documentation/latest/Deploy/Deploymentoverview ... View more

You can install the universal forwarder on a machine which already has an instance of full Splunk. However, it will not install over the full Splunk instance. Instead, they will exist side-by-side. ... View more

Forwarders send data to receivers, which are usually indexers. The "enable listen" command is the command that you run on the receiver, not the forwarder. It allows the receiver to listen for data coming from a forwarder. How you set up a deployment server to communicate with deployment clients is a separate issue, which is convered in the earlier steps in that example. For more information on forwarding and receiving, refer to: http://www.splunk.com/base/Documentation/latest/Deploy/Aboutforwardingandreceivingdata ... View more