I have a couple of questions.   - I have my searchhead and indexer on the same server. I know that my domain controllers and the universal forwarders on it are installed correctly I'm receiving AD data en securityeventlogs in splunk. However every search with Splunk app for windows infrastructures will came up empty   - beside that is the performance of my splunk instance very slow and now  i have the error messages: the tcp output processor has paused the dataflow forwarding to host_dest= etc...... Now it seems that i'm don't receive data anymore. It happened after i putted an input.conf in de app for windows infrastructure local folder. After I removed it i still don't receive any data.   I'm stuck now. What can i do to fix - the performance issues - that i don't receive data anymore - that the app for windows infrastructure will be working ( i really followed every step and all was checked green @ the setup). THanks for helping me ... View more