Thank you amiracle. Is there a way you can explain to me how this works, I am not that Splunk savvy...A detail explanation on how this works in the light of what we want to do will be great. We are torn between how to either move the entire on-prem instances to AWS at once, or do an hybrid move. Do you also have any insight as to how we can move all the data in the on-prem indexers to AWS (either to the S3 buckets - like having S3 buckets for each indexer and move corresponding data into each). Do we need 2 licenses to make this happen, or same license can be utilized for both Hybrid and on-prem instances. My thought is that the data comes through same pipeline and then get sent to the on-prem and AWS instance through a LB, this way same license can be used, is this correct? Thank you for your great help! ... View more

I believe your ES SH can connect to your AWS indexers (I may be wrong). The documentation speaks of Splunk Cloud (different from AWS deployment). This is my thinking. Sending data from your cloud to your on-premise will involve significant cost depending on the volume of data being sent. If you have solved this issue, kindly please share your solution. Thanks OP ... View more

I think you can use Citrix analytics. ... View more

use appendcols instead of Join ... View more