What you wanted to do is bootstrapping. https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/BootstrapaSmartStoreindexercluster For the actual command, you can check this thread. https://community.splunk.com/t5/Knowledge-Management/SmartStore-What-is-Cluster-bootstrap-process/m-p/401827 ... View more

Issue was with the syslog config on Cyberark. ... View more

The feature was introduced in Splunk 6.6 (see Release Notes) in May 2017. Feature: New SQL-like IN SPL operator New SPL operator that acts as a shorthand for multiple disjunctions of one field. See Comparison and Conditional functions and search in the Search Reference manual. ... View more

Indexer discovery used in Multisite clustering There can be many reasons for this failure, including the ones listed above. An additional reason that this message comes up is because of indexer discovery when using multisite clustering. When using multisite clustering, every forwarder must have a site. If you wish to avoid site affinity, you may use site0. The configuration looks like this: # server.conf [general] site = site0 References: 1. http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/indexerdiscovery#Use_indexer_discovery_in_a_multisite_cluster "Important: When you use indexer discovery with multisite clustering, you must assign a site-id to all forwarders, whether or not you want the forwarders to be site-aware. If you want a forwarder to be site-aware, you assign it a site-id for a site in the cluster, such as "site1," "site2," and so on. If you do not want a forwarder to be site-aware, you assign it the special site-id of "site0". When a forwarder is assigned "site0", it will forward to peers across all sites in the cluster." ... View more