Hi, will you be able to post the inputs.conf of indexer and outputs.conf of UF? ... View more

Hi, if you concern is performance issue. You may wish to consider in optimizing your searches. Here are some of the pointers. Avoid extracting fields in search (rex). Try to extract the field first using props and transforms. Avoid using keyword searches like "[ACCESS]". Use key-value pair instead if the fields are extracted. Specify the sourcetype in your search. The index may contains multiple sourcetypes depending on your setup. Use automatic lookup for your "Request" field to lookup the type of request. Prerequisite that the request field must be present during searching. You may also like to watch this past .conf video for some recommendation in optimizing your searches. https://conf.splunk.com/files/2016/recordings/search-optimization.mp4 For your case, it is not recommended to write the result into lookup and the present it again on dashboard from lookup. ... View more

Hi, You will need to point the Search Head to Master Node. Search Head will discover the Search Peer via Master Node. You do not need to add Search Peer in Search Head. If you want to do it via Web Console, do this on the Search Head. http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Enablethesearchhead#Enable_the_search_head_2 If you want to do it via CLI, follow these steps on Search Head. "Integrate with a single-site indexer cluster" http://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/SHCandindexercluster ... View more