i think the issue here is that specifying wildcards creates an implicit whitelist for that stanza. the longest fully qualified path is used as the monitor stanza, and the wildcards are translated into regular expressions. the docs say "As a consequence, you can't have multiple stanzas with wildcards for files in the same directory. If you have multiple inputs that only disambiguate after a wildcard, they will collide." check out more here: http://www.splunk.com/base/Documentation/latest/Admin/Specifyinputpathswithwildcards#Wildcards_and_whitelisting ... View more

it looks as though you can give a role the edit_user capability (in authorize.conf) to allow this: [capability::edit_user] * Required to create, edit, or remove users. * Note that Splunk users may edit certain aspects of their information without this capability. * Also required to manage certificates for distributed search. ... View more

typically, the compressed, persisted data that Splunk extracts from your data inputs amounts to approximately 10% of the raw data that comes into Splunk. the indexes that are created to access this data can be anywhere from 10% to 110% of the size of the data that comes in. this value is affected strongly by how many unique terms occur in your data. (from http://www.splunk.com/base/Documentation/latest/Installation/HowHowmuchspaceyouwillneed ) ... View more

yes, the forwarders will use the same logic (described here: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ) to read their configuration files as a standard Splunk deployment does. ... View more

this was changed to splunkd search in 4.1. i will add a note to the upgrade docs to make sure people find that out. there's some info about managing search jobs here: http://www.splunk.com/base/Documentation/latest/Admin/ManagejobsintheOS ... View more

there's also some good info in the official docs here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more