Hi @KKuser , at first, don't attach a new question to a so old one (nine years ago!) even if on the same topic because it's difficoult to have an answer, it's always better to create a new question. Anyway, if you need information about a validated Splunk architecture for an on premise or hybrid installation  see at https://docs.splunk.com/Documentation/SVA/current/Architectures/About Anyway, in Splunk Cloud you only see two machines: one Search Head for ES and one Search Head for the other apps. You don't know if there's a Search Head Cluster, probably not also because you see only two machines and SH Cluster need three machines. In addition you can upload apps and this operation isn't possible on SH Clusters. In addition, the Indexer layer ss not visible for you even if you see three Indexers and you cannot see the Cluster Manager.  Surely there are many instance of Splunk Cloud in different AWS machines. For more information see at https://docs.splunk.com/Documentation/SVA/current/Architectures/SCPExperience Ciao. Giuseppe ... View more

Hi cpraz_ord, I've got a couple of queries that I like to use for this exact purpose. This is under the assumption that you are forwarding all logs from your on-premise HF into the cloud. It’s not automatic, but you’d start by looking at the _internal index. This will give you a list of all the sourcetypes that the HF has handled. index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput | stats values(series) This will give you a list of all the indexes that the HF has handled. index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_index_thruput | stats values(series) That’ll return all the hosts pushing data through the HF. index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_host_thruput | stats values(series) Of course, you can use other combinations of | stats to get the formatting you desire, but these are the best starting points to help you start looking in the right places. edit I've refined the search a little for you to help you find which of the sourcetypes are the noisiest: index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput | stats avg(kbps) as kbps by series | sort -kbps Good luck! ... View more

https://www.cisco.com/c/en/us/td/docs/security/firesight/540/api/estreamer/EventStreamerIntegrationGuide/ConfiguringEstreamer.html ... View more