Hi @ppablo. The recommended way to do this is to use Deployment Server. We have documentation which will be shortly forthcoming explaining how to do this. The way it works is you have your indexers as clients of Event Collector. HTTP Event Collector has a global setting that you will configure on the deployment server "Use Deployment Server". In etc/apps/splunk_httpinput/local/inputs.conf it is the "useDeplyomentServer" setting under the [http] stanza. Once you set this, the collector will write all of it's configuration to the etc/deployment_apps/splunk_httpinput folder. Any time you use the UI or API to manage tokens, the deployment server will package up the updates so that the next time the clients (indexers) poll, they will get the latest tokens. The indexers will restart and load the new tokens in a staggered fashion. There's a little bit of manual setup on the deployment server initially before you set the settings. First manually create the etc/deployment_apps/splunk_httpinput folder. Then copy the config from etc/apps/splunk_httpinput in. As I mentioned, we'll have more docs coming in the next week or so that will show how to do this. Glenn ... View more

Hi Geoff On the listener itself we expose a FlushAsync method. That should force it to flush. We handle everything async with the loggers in order to get better perf/scale. The challenge is that the Trace interface is not really designed for Async, but FlushAsync should work for you. ... View more