Hi @ndavis4  Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under  SPLUNK_HOME/etc/system/local.  This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy. ... View more

Yes it could be a permission issue as well as mentioned earlier. sudo as splunk user and try to execute the script ... View more

Realtime takes much more ressources and I disable it by default. Ad-hoc search let your search into the stored data in the index tier. Realtime search send you the events before storing them. He have around 150 servers for Splunk at 40 000$ each and we still a reluctant to give that capability since we prefer to waste our CPU elsewhere. ... View more