First of all you should install Enterprise Security on the Search Head and choose add-ons which you need, then configure add-on pack in via Enterprise Security then download it and add to cluster master then push configuration to indexers Whole process is described in this article: http://docs.splunk.com/Documentation/ES/5.0.0/Install/InstallTechnologyAdd-ons ... View more

There are things that create fields automatically; you should make sure that you set KV_MODE = none also. Post an example event and the fields that shouldn't be there. ... View more

Thanks very much @Intermediate , will do. 🙂 ... View more

I'm pretty sure it was a permissions problem. Originally I tried this guide: http://wiki.splunk.com/Deploy:EnsuringSplunkRunsAsNonRootUser and it didn't workout too well. I started over and used the guide here: http://docs.splunk.com/Documentation/Splunk/latest/installation/RunSplunkasadifferentornon-rootuser#Instructions. That worked out well and everything seems to be fine with the exception of "boot-start" (http://docs.splunk.com/Documentation/Splunk/latest/admin/ConfigureSplunktostartatboottime#Enable_boot-start_on_.2Anix_platforms) not working. I'm going to start a new thread for that if I can't figure it out pretty soon. ... View more

I will indeed, thanks again. ... View more

Thank You frmaasdam! After waiting half a day, the machine with these changes started pumping in all logs that were missing. Also, after adding this change to other machines it takes about 1hour before the unread logs start pumping in. Thanks Again for all your suggestions guys! ... View more

To forward data to secondary site, when the primary site is down, we have a new feature in 6.6 that can handle this case automatically. More info: http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/indexerdiscovery#Configure_the_forwarder_site_failover_capability ... View more

using the settings of your first example, you can do: site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 with replication_factor=1, search_factor=1. however, this is identical to non-multisite clustering. the only advantage of this is that its easier to move from 1 peer per site -> multiple peers per site than to reconfigure. ... View more