Thanks very much for your answer and documentation, very much appreciated 🙂 It is very important to us to be about having 2 Indexers/peer nodes only. You mention it may not possible to have only two, and the documentation shows with 3 peers, you're right, but for me it is for the example purpose only ? Or it really must be greater or equal to 3 peers at least and so 2 peers cannot be implemented ?? thanks again, Kind regards ... View more

as mentioned, Splunk Software in Forwarder DO NOT store logs. So it is upto your log clearing application to do this job. So if it retains for 1 year, it will be there for 1 year and Splunk CAN start indexing from all remaining logs . the best way to tackle is, to send data to both your indexers and enable indexer replication. This way when ONE indexer is down, you can still send to other indexer as well as you will have a copy of data from other indexer. Link for overview Please upvote/accept if the replies helped you. ... View more