I am looking into simplifying my Splunk architecture. I currently have two Linux indexers in different regions. They are currently setup identical - same indexes, same everything. They are collecting logs for each region. We are migrating to a transit network that will have access to both regions. I need to take the data from both indexers and combine them together on a new Linux indexer. How do I merge the two indexers together? ... View more

I recently upgraded our Splunk Enterprise deployment up to 7.2.7 and Palo Alto Networks App to 6.1.1 and the Add-on to 6.1.1. I now receive the messages on the search head cluster members: Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup Could not load lookup=LOOKUP-minemeldfeeds_src_lookup I've looked through all the answers from previous threads and none of them fix the issue. Thanks. ... View more