"In fact you can run multiple inputs backing up and restoring multiple search head clusters from the 1 deployer if you wish, they would just need unique names and unique paths on the filesystem to store temporary files."   yes, we set up modular inputs on the standalone instance, it works.  ... View more

@LukeMurphey - Unfortunately , still see the 403 errors as before. Started to work as soon as we disabled the ENV variables defined in the splunk-launch.conf . ... View more

Thanks a lot @LukeMurphey, the rolling restart helped. Really Appreciate your help. 🙂 ... View more

You could build another system that access the DB and publishes the list on a webserver and use this app: https://splunkbase.splunk.com/app/635/ ... View more

gokadroid - Thanks for the response, I understand that the above steps are handy when creating a macro with Arguments. But my requirement was to be able to specify or call the macro in the following way index="blah" | multiplyABC(field1,field2,field3) where field1,field2 and field3 are not explicitly hardcoded values, instead they are Fields in the events found for index="blah". Based on my observation, passing event fields get treated literally instead of interpreting their values, i.e. the expanded macro search would look as follows eval dd=field1*field2*field3 ... View more

Alternatively, if it's different dashboards based on the results of the search then you could use sendresults https://splunkbase.splunk.com/app/1794/ (or it may make more sense to have multiple alerts). ... View more