I am currently using an index server on Windows to poll other Windows servers for WMI information for the Windows app. Can/shold this be done by using light forwarders on those servers? ... View more

I have a need to automatically roll data completely out of an index so that it's no longer searchable after a number of days. Is this possible? how do I go about it? ... View more

My Splunk server is listening to UDP port 514 for syslog information. How can I route data to a given index based on the originating host? For example, the network-related devices need to be routed to the index designated for those devices while security devices need to have their dat routed to that index. Thanks. ... View more

I have a Windows 2008 server running Splunkweb and I need to configure it to work with the certificate I've obtained through my organization. I was able to generate the CSR with some instructions I found on the web but cannot seem to convert it for use with Splunk. The docs do not appear to have anything specific to Windows and refer to shell scripts on Linux. Any help would be appreciated. ... View more

I've been asked to look into renaming my Splunk indexer server (don't ask why). Is there a "best" or safe method for doing this? On reviewing the config files, it doesn't appear complicated, but I wanted to make sure I wasn't missing something. Thanks. ... View more