What would be considered the Splunk best practice when managing multiple deployment servers in different locations that also act as log collectors, while wanting to keep configurations on each consistent as possible? Would it be a tiered deployment setup, utilizing /opt/splunk/etc/apps/ as the repositoryLocation in the serverclass deployed out to the HF/DS systems and also using this serverclass.conf to deploy out to Universal Forwarders that check into them, and then controlling which apps are enabled/disabled when they're distributed to those DS's on a central, top-tier DS? Or does Splunk recommend that something like Ansible or a similar technology be introduced to do this type of configuration deployment? ... View more

Trying to use a key-prefix when setting up a Generic S3 input that utilizes a wildcard in the path, but it doesn't look to be working. S3 key prefix = /AWSLogs/*/vpcflowlogs/ Has anyone had any luck in setting this up before? ... View more