Hi, modify the assets.csv file on the instance where is installed DMC file locate = etc/apps/splunk_management_console/lookups/assets.csv You need to update this file with the new/good informations (in my case new SH, change name/IP and ID if different) I just : modify my "distsearch.conf" on DMC instance modify the "assets.csv" on DMC instance add the trusted.pem on my new SH restart my new SH and my DMC instance and all is OK Hope help you ... View more

Yes ! You can have 2 Search Head Cluster and only one indexer cluster and request same data from each one SHC 1 : at least 3 SH + Deployer1 SHC 2 : at least 3 SH + Deployer2 => you need have one deployer by SHC to deploy apps on SHC 1 and other apps on SHC 2 The difference is in server.conf : same keypass under [clustering] stanza to exchange with master node of your cluster indexer but different keypass under [shclustering] stanza to have 2 SHC example server.conf on one SH of your new SHC [shclustering] conf_deploy_fetch_url = https://ip_deployer2:8089 disabled = 0 mgmt_uri = https://ip_new_sh:8089 pass4SymmKey = < NEW keypass between SH/deployer for your new cluster > shcluster_label = sh_cluster2 id = XXXXXXXXXXXXXXXXXXXXXXXXXXXX [clustering] master_uri = https://same_ip_on_each_SH:8089 mode = searchhead pass4SymmKey = < same keypass you have on your master node > [general] serverName = sh01_cluster2 pass4SymmKey = < same keypass you have on your licence server > [license] master_uri = https://same_ip_on_each_SHC:8089 ... View more

Hi all ! You can check number of elements by indexer |tstats count where index=index_name by splunk_server _time span=1d |timechart sum(count) as count span=1d by splunk_server Just indicates the name of your index et change the span as necessary (day, month, ..) ... View more