hi @cisaksen, 1. Yes maxBundleSize is in GB. The default value is 2GB. 2. Not all configuration files. Some configuration files (like authorize, props and transforms etc.) and assets like (csv/kvstore lookups etc) are copied to bundle. The search head replicates the knowledge bundle periodically in the background or when initiating a search. 3. metrics.log - indexed in _internal index. index=_internal sourcetype=splunkd group=bundle*   4. No, The search head replicates the knowledge bundle periodically in the background or when initiating a search. You can run a search to replicate a newly cerated asset/config to search peers.   Check this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/Knowledgebundlereplication   If this reply helps you, an upvote/like would be appreciated.   ... View more

Hi @cisaksen, probably (but non Splunk certified) a Splunk Cluster runs on little different versions (e.g. 14-15) of the same Linux. I'd have many dubts about different Windows versions that are really different one by one (2016 is really different than 2019). Anyway, I'd avoid to use Windows servers on production systems and upgrade of Linux systems to the same version isn't so heavy! In addition I'd use the same os version also to avoid that at the first problem Splunk Support doesn't help you. But this is only my opinion: Splunk says to use the same Operative system. Ciao. Giuseppe ... View more

Thanks for the reply, but i found that the above syntax is actually working there are other issues as to why i'm not seeing what I think I should be. Thanks again ... View more

You can just use the CLI. For every inputs.conf stanza that you would like to enable, just copy that stanza header into a new inputs.conf file inside of the local directory and add disabled=false to it (NOTHING ELSE). Copy any other lines that you would like to change in each stanza and change them in local , too. ... View more