Currently, we have a standalone deployment, with about 2 TB of data on it. We want to move to the recommended architecture of 3 indexers, 1 indexer cluster master, 1 license manager/monitoring console, and 1 search head because of our anticipated increase of log ingestion. We want to keep our current standalone server as the new search head because we’re pretty far deep with custom reports/dashboards/extracted fields/etc. The documentation here https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Migratenon-clusteredindexerstoaclusteredenvironment recommends just adding the current standalone server as an indexer to the cluster, but that doesn’t work for our scenario because we want to keep it as the search head. I’ve already set up and configured all of the new indexers, cluster master, and license manager/monitoring console, just trying to figure out the best way how to migrate the standalone server to the search head without losing all of our custom reports/dashboards/extracted fields/etc and also keeping all of our current data. Whats the best path forward? ... View more

Does anyone know the functionality for the Universal Forwarder and its caching of logs if its disconnected from the indexer. Specifically, what is the functionality of caching a file when it gets rotated to a zipped file while its still disconnected from the indexer? Do we lose everything that got rotated to a zipped file? Or did everything still get cached, regardless of the log rotation happening or not? ... View more