We run the following on the Gold Image • Stop the service SplunkForwarder (but leave the start type at automatic) • Open an administrative command prompt • Run the command: C:\Program Files\SplunkUniversalForwarder\bin\splunk clone-prep-clear-config • Prepare the machine for cloning as necessary, and we didn't reboot them This works fine, each server is correctly visible on Splunk. We boot all our servers each weekend. After the reboot we receive around 10GB, and all other day's around 2 GB Why did he collect each week all data again? ... View more