Use : | where _time>=relative_time(now(), "-3m@m") AND _time<=relative_time(now(), "@m") ... View more

Many thanks for the guidance  Ismo @isoutamo  ! For reference here is what I did to make it work. for example if I want to install a second instance called "SH": 1. Under /opt create a directory called SH 2. Install the 2nd (or n-th) instance in a different location using :   tar -zxvf <splunk install tgz file> -C /opt/sh 3. In /opt/sh/splunk/etc duplicate the file splunk-launch.conf.default to splunk-launch.conf 4. edit the file splunk-launch.conf in /opt/sh/splunk/etc to reflect chnages to the SPLUNK_HOME and Splunkd daemon name like so: # Version 8.0.6 # Modify the following line to suit the location of your Splunk install. # If unset, Splunk will use the parent of the directory containing the splunk # CLI executable. # # SPLUNK_HOME=/opt/splunk-home SPLUNK_HOME=/opt/sh/splunk # By default, Splunk stores its indexes under SPLUNK_HOME in the # var/lib/splunk subdirectory. This can be overridden # here: # # SPLUNK_DB=/opt/splunk-home/var/lib/splunk # Splunkd daemon name #SPLUNK_SERVER_NAME=Splunkd SPLUNK_SERVER_NAME=Splunkdsh   5. switch to the directory /opt/sh/splunk/bin/ and run ./splunk enable boot-start -systemd-managed 1 (see docs here  ) You will see that a splunkdsh.service file was added to /etc/systemd/system 6.  Accept the LUA, set admin user and password 7 ./splunk start change http port, mgmt port, appserver port, kvstore port to different ports since you are on the same IP 🙂 Enjoy !   ... View more

Getting back to this question just to let you know that I've found the right solution. There is away to tell the second indexer to take the events back to parsing queue. What you need to do is to add the following line in the inputs.conf of the receiving side. route=has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue; Link to the blog post where I've first learned about it :  https://splunkes.wordpress.com/2019/09/02/re-parsing-queue   On splunk docs (search for "Data distribution: ") https://docs.splunk.com/Documentation/Splunk/7.3.5/Admin/Inputsconf       ... View more