As for how to upgrade them... You'll need to write scripts that take into account the architecture of each os, among other variables. http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/UpgradetheWindowsforwarder http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/UpgradetheNixforwarder http://docs.splunk.com/Documentation/Splunk/6.1/installation/HowtoupgradeSplunk For windows, i've used winrm and powershell remoting. For linux I've used everything from bash scripts to python. As for compatabillity between versions: http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers ... View more

Try these links https://answers.splunk.com/answers/6521/expanding-splunk-installation-from-a-single-indexer-to-a-multi-indexer-dedicated-search-head-environment.html http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/UpgradeyourdistributedSplunkEnterpriseenvironment ... View more

The post here explores a way to "to modify indexed data or prune "deleted" data from the index" might be worth a read 🙂 https://wiki.splunk.com/Community:Modifying_indexed_data_via_export_and_import ... View more

Somehow managed to work by using sourcetype=csv-2 It did worked as expected. Thanks.. ... View more

Also. Can you help, If I need for one hour timechart with complete 60 mins info to display? ... View more