Thanks for troubleshooting with me all the way through to the end! If you appreciate the effort I put in, feel free to let others know by recommending me on linkedin. https://linkedin.com/in/global-splunk-consultant Thanks in advance! ... View more

Thank you for the suggestion. We are really looking for a scenario where we can just point the license server to a different IP address and it would work the same as it did with the primary. We tested this on the hostname for the search head itself, and the failover worked fine. What's different about the license server where this won't work? What if we call the Master_URI in the server.conf for both the Primary and Standy search heads "self" instead of using the name of the license server? Any other suggestions? ... View more

hi @starcher, I am forwarding logs from sophos to central syslog server. the logs are getting save in /central/%hostname% location. I install the universal forwarder on syslog server and also install the sophos add on SH. Now what should I put input.conf and output.conf. ... View more