Hi bgagliardi1, If i have not misunderstood, I hope to archive the same goal you're aiming for. I'm fine with UF load balancing system against indexers when that's installed on a win/nix client that send directly to an index cluster. At the end of the day, if the UF goes down due to server failure or scheduled maintenance, the server itself goes down with him. I want to have forwarder redundancy for those devices which can send syslog just to a single destination. Did you find any solution? I was thinking to just create a VIP/Pool/monitor for each needed TCP/UDP data input. ... View more

Hi guys, I'm new to splunk and WebAnalytics and I have a similar problem. tag=web from the app context search return data but I can't see the field host. I suppose that's the reason for the field site not being created. Any idea why i can see the field host in the search app for sourcetype=iis but not on the context app for tag=web? Best Regards ... View more