You can indeed configure different home/cold paths in etc/apps/<someapp>/local (please not in system/local ) to accomplish that. I wouldn't consider it invalid, it's just annoying to manage. Once you have things fully migrated you should work to moving your CM-deployed configuration to what it needs to be for the new indexers, and remove the manually installed configuration. ... View more

Considering the update to the question, look into this setting in outputs.conf: autoLBVolume = <bytes> * After the forwarder sends data of autoLBVolume to some indexer, a new indexer is selected randomly from the list of indexers provided in the server attribute of the target group stanza. * autoLBVolume is closely related to autoLBFrequency. autoLBVolume is first used to determine if the forwarder needs to pick another indexer. If the autoLBVolume is not reached, but the autoLBFrequency is reached, the forwarder will switch to another indexer as the forwarding target. * A non-zero value means the volume based forwarding is turned on, and value 0 means the volume based forwarding is turned off. * Defaults to 0 (bytes). ... View more

You would need to put $site_code$ in quotes, like this: | inputlookup myfile1.csv | append [| inputlookup myfile2.csv ] | where status!="H" | eventstats dc(status) as status_cnt by site_code | where status_cnt=1 and status="C" | table site_code | map [|inputlookup myfile1.csv | where site_code="$site_code$"] I changed search="..." to [...] to make this easier to read. You could combine the where with the inputlookup , as well: | inputlookup myfile1.csv | append [| inputlookup myfile2.csv ] | where status!="H" | eventstats dc(status) as status_cnt by site_code | where status_cnt=1 and status="C" | table site_code | map [|inputlookup myfile1.csv where site_code=$site_code$] Note that this version doesn't require double quotes around $site_code$ . This is because the where clause of inputlookup assumes the right hand side will be a value, whereas the where command allows you to pass field names on the right hand side, or values if in quotes. So your | where thought you were saying | where <fieldA>=<fieldB> instead of |where <fieldA>=<valueB> . ... View more

It sounds to me like your forwarder is unable to resolve the hostname. From that server try these to help troubleshoot: ping ourhost dig ourhost If your forwarder can't resolve the hostname to an IP address, you should first determine why. If it's a reasonable answer (split horizon DNS, etc), perhaps you just need to hardcode the IP address into outputs.conf. Or perhaps work on getting the name resolvable by DNS. ... View more