DO look at search head pooling documentation. Deployment server you have to use no other option for you when you are having more than 1000 forwarders 😉 ... View more

I have a problem with this app ... On one server dropdown list for Dimensions is working, on another server is not working and on local machine also not working. What is going wrong here? I have to mention that on local machine i don't have full admin rights. I don't know what kind of rights i have on the not working server and also i don't know if i have some or full admin rights on working server. This problem could be generated by admin rights? Thank you. Bogdan. ... View more

Pretty weird it isn't still included in some config file, an option to 'hold indexing' when e.g. 99% of the daily license is used. Limits.conf (what's in a name) can't limit the license usage... For multiple test environments with their own splunk environments where unexpected things occur daily, you don't want the hassle of having to monitor the license during the day. Or when something in a long weekend is bouncing and dumping, you don't want this annoying license warning coming at ya. Can't be so difficult to have this option. Yes, you can with a larger environment do some remote searches and make a splunk-stop script for the heavy forwarder. But on a single server it'll bring the whole webinterface down as well. On production environments I understand it's not desired usually to implement. ... View more