I would suggest to use the big 6/8 of props.conf Your props should contain these "TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD" and add "DATETIME_CONFIG = current". DATETIME_CONFIG is when Splunk can't find something to match TIME_* . ... View more

Run this command to check if the forwarder is connected to the receiving instance. "splunk list forward-server" , the indexer's ip should be in active state. If its active , the next things to do is to check the splunkd.log of the universal forwarder. ... View more

In the bucket status dashboard you can see why the fixup task per bucket is in pending. One of the reason is that, it was not roll to warm yet. Did you put the cluster to maintenance mode and gracefully shutdown the indexer? You have fixed up task because 1 indexer is being shutdown and it stops sending heartbeat to the Cluster master. This causes the master to detect the loss and initiate remedial action and will replace bucket copies on a downed peer by coordinating the activities to other peers. You can check more details here: https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Whathappenswhenaslavenodegoesdown ... View more

Have you tried the host_segment = 3? If you only want the last four digits you will need to use transforms and props in indexer or HF so you can reassign and extract the host field. Are you doing this by Splunk UF -> Splunk Indexer ? sample tranforms.conf [overridinghost] REGEX = AppName_(?<host>[0-9]+) FORMAT = host::$1 DEST_KEY = MetaData:Host props.conf [sourcetype or the source] TRANSFORMS-serverhost=overridinghost ... View more