Hi, I would like to set up SSL communication between UF and Indexers but when I check the docs and wiki, I see that I have to either: 1- Copy the Indexer certificate WITH the its private key onto UFs (see part 3 of https://wiki.splunk.com/Community:Splunk2Splunk_SSL_3rdPartyCA) 2- Or I can create a client certificate besides the Indexer certificate (see https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/ConfigureSplunkforwardingtousesignedcertificates#Configure_your_forwarders_to_use_your_certificates) The second option seems more secure because I would not have to copy the Indexer private key onto UFs. But this also means that a private key (the UF's) is available on the client... This is not really secure because the client is always more vulnerable than a server. The best way I can think of is to keep only one private key, and keep it on the Indexer. Is it doable? If not, what happens if a "hacker" gets the UF private key (second option)? Can he read the communication and alter the communication? Thanks ... View more

Hi, We would like to use the same Data Model (same field extractions, same events, same acceleration window, etc.) in two different SH Clusters. Is it possible to do it without having to compute and store the acceleration files twice on the indexers? Thank you! ... View more

Hi, I'd like to calculate the average latency (_indextime-_time) with the tstats command, but I can not make it work: | tstats avg(_indextime-_time) where (index=* OR index=_*) by index Splunk thinks "_indextime-_time" is a field name. How can I compute the difference in the tstats? Thank you ... View more

Hi, I can't find any reference in the docs (i.e. : http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Propsconf) of Props or Transforms about which attributes are available/working on an Universal Forwarder. Is there any exhaustive documentation about it? Thank you ... View more