Hello all, We are replacing our single Splunk indexer with a pair of new indexers and have migrated all the indexes except those filled by syslog sources. We know that sending syslog straight to an indexer is not best practice, so we are now looking at directing this to SyslogNG first. However, we would like to make use of the old Splunk indexer server to take the output of syslogNG and load balance it to the two new indexers. What we don't understand is if this is simply a matter of editing the old indexers outputs.conf or if the indexer will still need to function to take the different UDP data input ports and direct them to the correct indexes. Thanks in advance! ... View more