Splunk forwarders are light weight agents installed on all endpoint machines(where ever possible) to pull data and sent to Splunk cloud. Both deployment server and forwarder has Splunk daemon process which interacts each other (default 8089 port but can be changed) An universal forwarder, a small footprint agent. Splunk has mainly 2 package,one is universal forwarder and other is Splunk enterprises.You need to built a system with Splunk enterprise and install DB connect app there.The DB connect app from this instance will directly interact with your DB instance to pull data and send it over Splunk cloud.You can use Deployment server to install DB connect app since deployment server uses Splunk enterprise installation. You can configure a single splunk server to collect all your data and send it to Cloud.Keep it in mind it is really depend on how much data you are transferring through a single server. Splunk license requires only when you index data locally.But I thinnk you require dummy licenses for other instances.Better contact sales persons. NB:- Regarding Splunk cloud prerequisites and cost,please reach out to sales persons.They will answer all your queries and suggest you better splunk deployment in you environment.Accept this answer if you find helpful. ... View more

1 - Run on each search heads. master_uri is your Indexer's cluster master. https://docs.splunk.com/Documentation/Splunk/7.1.1/DistSearch/SHCandindexercluster 2- Add instances as search peers in your monitoring console instance,then setup monitoring console: https://docs.splunk.com/Documentation/Splunk/7.1.1/DMC/Addinstancesassearchpeers https://docs.splunk.com/Documentation/Splunk/7.1.1/DMC/Configureindistributedmode 3- You can use UI,CLI or configuration file. Configuration file makes sense to deploy from deployer to all SHs. https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Serverconf#License_manager_settings_for_configuring_the_license_pool.28s.29 http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Configurealicenseslave http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/LicenserCLIcommands#Managing_license_slaves http://docs.splunk.com/Documentation/Splunk/7.1.1/DistSearch/PropagateSHCconfigurationchanges As you can see everything is documented in Splunk. ... View more

Try this: index=machines environment=production | join domain-name [ search index=admin environment=administrator | dedup domain-name] ... View more

Try the below driver: MS-SQL Server Using jTDS Driver with Windows Authentication And jdbc:jtds:sqlserver://:1433/master;useCursors=true;domain=;useNTLMv2=true ... View more