Yes, you can use an indexer, but you a little over the recommended limit. You will have to review your server hardware and workload to see if it can support the extra work. If you find that after you configure the deployment server that it should be on it's own server, then the configuration can be relocated to a new server. You can manage the inputs.conf and outputs.conf, but you will need at least two apps, one for windows and one for unix. If all of your windows and unix configs are not exactly the same, then you will need additional serverclasses for them. The quick 'developer minded' guide for setting up and troubleshooting a deployment server can be found here: http://wiki.splunk.com/Deploy:DeploymentServer The Splunk documentation for configuring a deployment server can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver Take the time to read and understand the material. A deployment server is very handy, but it must be configured correctly and each configuration is specific to the deployment - there is no magic plan that works for everyone. ... View more

No, the command line only allows you to set the default forward server with the splunk add forward-server command but does not allow you to set up custom tcpout stanzas like the above. If the issue is you can't edit the Splunk\etc\system\local\outputs.conf since it's telling you it's read only, you can copy the existing one on to your Desktop, edit it, and then overwrite it in the original location assuming you have Administrator privileges. After, you'll need to restart the Splunk service in order for it to change the settings. If the issue instead you need to do everything from the command line for a script or such, you'll have to script something that works with the outputs.conf file directly rather than trying to interface with Splunk at the command line. ... View more