Thanks. Just to confirm, this means I can just edit the local/inputs.conf on just the indexer, and ignore the inputs.conf on all the other forwarders?
I'm trying to determine the best configuration that keeps the daily volume of stuff indexed under the 500mb quota, so having to edit all the inputs.conf might become problematic. Doing it just on the indexer would make tuning much faster.
... View more