hello there, in general, you can use one of 2 ways: 1. syslog server to collect the fortinet logs and install a Forwarder to monitor the syslog directories and 2. Heavy Forwarder listening on UDP to the fortinet firewall and sending the data to indexers in both cases, you have 1 IP that fortinet will send data to, and from that point, data will be load balanced to the 3 Indexers there are many many articles in this portal and in community regarding considerations on both options. use your favorite search engine, try something like: "splunk forwarder vs. syslog" hope it helps ... View more

yes you can, just add the new one as a license slave to the existing splunk license master. on new instance: navigate to settings - > licensing -> change to slave -> add the license master info and port -> save ->restart now on your original license master, navigate to settings -> licensing -> scroll down and click all slaves -> verify your new indexer is there. from the same page you can als \o create a pool and set a license threshold for new indexer by editing pools more on this topic here in docs: http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Configurealicenseslave ... View more