I see capabilities in Splunk are defined in the authorize.conf. For security reason, i want to disable the delete by keyword capabilities in Splunk so no user could delete any data in splunk. Could I just delete the line which define capabilities and all roles related to it. ... View more

I know that we could configure Auto-load balancing on multiple indexer. But I want to use an active standby approach to license count on duplicated data. In this case, could I configure the forwarder to route all the event an indexer primarily and route to another indexer when primarily indexer is not available. ... View more