Hi , I want to sent the application, system and security logs from the domain controller server to the main Splunk server but it is not sending it. As a workaround, I have installed Splunk Enterprise of DC servers and changed their licensing to 'Forwarder'. This method is working but the CPU and memory usage sometimes increase to the extent that my server gets hanged.  Could you please assist me in setting up Splunk forwarder on my DC server so that the server's memory and CPU usage can be decreased. similar problem happened to my others servers but replacing the Splunk enterprise with Splunk universal forwarder resolved the issue but I can't do it for the DC servers. ... View more

Can I migrate the Splunk Enterprise server from virtual machine to physical server? ... View more