1. Calling specific people to answer your question is plain rude. This is a volunteer-driven community and people respond to publicly posted question if/when they want. If you want a response in a timely manner - you have to purchase some support/consultancy services from one of many Splunk partners or Splunk's own Professional Services. 2. Digging up a thread from 5 years ago is not very likely to produce meaningful results. Create a new thread, describe your problem. If your problem is similar to an old one, you could link to the old one for reference. ... View more

Hi Woodcook, Can I ask why you never really answered the core question in stead of asking him to add a new question? His question was super relevant. ... View more

When, you'll be ready, remeber to accept or upvote this answer. Bye. Giuseppe ... View more

In one case where I have used this method the data on the source UF has this configured to send to a different HF, not just an indexer. So this still works as long as the HF's are sending their data to different indexers. You probably could set up the HF to do this instead, but in my case it worked better to send certain parts of the data from the UF to a different place (non-default) than the indexers for filtering (on the HF). So the server with the HF gets the inputs.conf as I showed, but instead of using the indexers in the server , use the server config to an HF, which forwards its received data to a set of indexers. [tcpout:other_splunkreceiver_9997] disabled=false autoLB=true server=hf1:9997 ... View more

Hi Maraman, Thanks for responding to my question. Yes, I think you are right. Nowhere in splunk docs did I find how to get this done. May be I need to fill a enhancement request for this feature. ... View more

hello @bharadwaja30 did you get a chance to try the theory? ... View more

Copying the etc/system/local folder is not a standard upgrade process, nor is it facilitated by our installers. Glad you got it all figured out! ... View more

Thank you javiergn. This query answered my question. ... View more