@VatsalJagani - So from your statement "A primary copy of the bucket: There will be always one primary copy of the bucket, regardless of whether it's a single-site or multi-site cluster" - you are saying always one primary copy in the cluster. But if you look at the below lines in the doc, we can keep more than one primary copy on different sites.  https://docs.splunk.com/Documentation/Splunk/9.0.2/Indexer/Multisitesearchaffinity  "There are also ways to configure the site search factor to ensure that all sites have searchable copies, even without explicitly specifying some or all of them. For example, a three-site cluster with site_search_factor = origin:1, total:3 guarantees one searchable copy per site, and thus enables search affinity for each site. Each site will have primary copies of all buckets." Let me know your thoughts on this. Happy Splunking.       ... View more

Hey @VatsalJagani   One doubt, For example- SF=2 & RF=2 are set. If the searchable bucket copy is present in the multisite(2 sites here) index cluster. i.e Site1 = searchable bucket  Site2 = searchable bucket  Does both searchable bucket act as primary search copy in the indexer cluster?   ... View more

@richgalloway  One more question: If we are going to use the below settings: site_search_factor = origin:1,total:2   Is there a chance of 2 search copy will be there on the same site?   ... View more

Hey @richgalloway , Thanks for the answer. So post-change the config only Cluster master required restart? ... View more

Hi @lguinn2 , I liked the above answer. I have one requirement where have 3 sites and planning to keep to search factor. Current Config: [clustering] site_search_factor = origin:1,site1:1,site2:1,site3:1,total:3   To making into 2 Search Factor in any sites will the below settings works? [clustering] site_search_factor = origin:1,site1:1,site2:1,site3:1,total:2             ... View more

Hey @povares_splunk Splunk_TA_microsoft-cloudservices/bin/splunktamscs/ca_certs_locater.py TEMP_CERT_FILE_NAME = 'httplib2_merged_certificates_{}.crt' Whenever the inputs run this script creates the cert file under /tmp/ directory and it will never get deleted and making /tmp/ directory full. Is this a bug with the App?  OR It's required to create a cert file while running inputs?   Regards, Arun Sunny  ... View more

@soumyasaha25 - I have around 50 endpoints so I can not create 50 serverclass. I am looking for a better approach to push the configs. ... View more

@martin_mueller - I have a question on declaring calculated field names with spaces? For Example: EVAL-Cricket Team Name=team_name Will this work? ... View more

Yes, it's all managed by DS but I do not want to restart them at the same time. So I am looking for a script where it does the rolling restart in this case. ... View more

I am looking at the rolling restart of the endpoint agents. (It's Just a Splunk universal forwarder agent installed on all the endpoints) ... View more

Thanks, @gcusello for the quick response. The problem which I have is we don't have any control over the inputs. ( The end users can send data with any source/sourcetype, So I need remediate that on our end) My problem statement is - I need to discard the events regardless of any source/sourcetype coming to a specific index. ... View more

Can we use a wildcard something like below? [source::*] [host::] [] ... View more

I'm creating a table using Splunk query index=student sourcetype=student_details | table Col1 Col2 OnlineTeslink ... View more

@soumdey - The great thing is you reduced the duplicate usage of Splunk License. ... View more