Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need: index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps" Chris ... View more

I'm not sure I quite understood what you mean by "not sharing an index between the machines". But I'll have a go at it: Splunk will perform best if you scale horizontally, if you have a lot of dedicated indexers, they can all do the work at the same time. So for your scenario you could use one server as a combined indexer and search head and the other machine as a dedicated indexer. Both servers should have the same indexes configured (they will store the data received locally and do not have a shared filesystem or anything like that). Then you set up the forwarders to auto load balance their data to both servers (There is an example here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf) If for some reason you do not want to have half the data of a specific index on one server and the other half on the other, you could use both servers as indexers & search heads and the split up the data you index among them ( You could habe application1 and application2 on server1 and application3 and application4 on server2. If there is a team looking after application1 &2 and another one looking after application3 & 4 that might make sense). But to me the first setup makes more sense. If you can explain a little what you mean by the least amount of disruption to users, we might be able to give you better assistance ... View more