Hi alanfinlay! Yes I did that and got ./splunk: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.4.0, stripped This seems to be correct. Should I try a different distro of linux? If so, what? Thanks! ... View more

I am running linux mint 32. Everything seems to be fine on it, and --debug gives the same error. I ran as sudo and got: ./splunk: 1: ./splunk: Syntax error: "(" unexpected ... View more

Thank you. ... View more

Ok. But my initial question remains - if one instance of Splunk indexes data, sends that indexed data to another instance of Splunk, does that instance have to re-index that data to get anything meaningful out of it (such as alerts, etc)? ... View more

Great, thank you for the info. Let's say that now, instead of that one first forwarder, I have 10. 10 'heavy forwarders' pointing one free license will go over the 500MB limit. I am trying to index the data locally, send that data to a central server for viewing. This way each instance stays below 500MB. Does this seem like a reasonable architecture? Or does that central server have to re-index all that data, in which case there is no point in indexing on the local servers at the first level. Thank you for your time. ... View more

Exactly. My next question is, how can I only have it index on the first server, send the index data to the second, and get dashboards etc from the second without indexing it? Does the second instance of Splunk HAVE to index the data in order to get anything meaningful out of the data (alerts, etc? Thanks! ... View more

I'm not entirely sure. I think it is considered a heavy forwarder because I still have Splunk Web enabled and all. My question is, is the data counted for each instance of Splunk? Or does the data index on the first server not count as indexing data for the second server? ... View more

I am using Splunk's forwarder capability. I am NOT using a universal forwarder. ... View more