What is a command depends on your point of reference. From the perspective of the operating system/shell, "splunk" is the command and everything else is arguments. From Splunk's perspective, the first argument (other than options) on the command line is the command. Since the documentation is written from Splunk's point of view, it doesn't make sense to treat "splunk" as a separate command since it is necessary to invoke any of the other commands.  IOW, what Splunk documents as commands are directives to Splunk and so the leading "splunk" is implied.  ... View more

The solution depends on which HEC endpoint you're using.  If you're using the event endpoint then props  are ignored and the timestamp must be in epoch format. See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.0/get-data-with-http-event-collector/http-event-collector-rest-api-endpoints for details. ... View more

If HTTPS is used and sslVerifyServerCert is set then both sides of the connection must use the same certificate.  See https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.2/secure-splunk-platform-communications-with-transport-layer-security-certificates/configure-tls-certificate-host-name-validation-for-secured-connections-between-splunk-software-components and https://splunk.my.site.com/customer/s/article/Where-are-SSL-Configuration-Files-located-How-to-configure-them-in-Splunk-Enterprise for details. ... View more

There is only one default TLS port.  You can, however, configure others.  See http://splunk.github.io/splunk-connect-for-syslog/main/sources/#unique-listening-ports ... View more

You're correct.  Those setting say to use all but 10GB of the 15TB so you should have plenty of storage. ... View more