Hi, We noticed the disk space is crossing the threshold >85% for the /opt/splunk mount point in one of our Dev Splunk AWS instance.On checking we are getting multiple error entries in splunkd.log for authentication failure as below. We did try to reset the admin password to check if it resolves as per https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html but it did not help. Please let us know what is the reason for the issue. 08-22-2016 09:37:21.345 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin 08-22-2016 09:37:21.397 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin Error entries in audit log 08-22-2016 09:52:33.442 -0400 INFO AuditLogger - Audit:[timestamp=08-22-2016 09:52:33.442, id=22436721, user=admin, action=login attempt, info=failed][CVflHg3ekijQ+pPJxiiEPzHYxYkf6URGn8U7moMrgcezqbmJYnZjkFtn/KS4sIfb5Di91lblaZlmTaymQj4ey21AhyUUOR5t7Vyr81wcovG1vLSUN0OWLu3uuHn1oUFNysW9u29gMa0dMIzQ7Apv+gjL00GtMWX6Rr9WW46lhDc Please let me know if there is anyway to resolve this. Thanks, Soumya ... View more

We need to do indexer archiving. We have a clustered environment with 4 Search Heads and 4 indexers each. Can anyone suggest if you have ever tried the option of using coldToFrozenScript in the indexes.conf? If yes, let me know what details have to be mentioned there and how can it be used. Thanks, Soumya ... View more