Hi that’s the way how it has planned to work. You could look more details from job inspector. It’s ok to do it that way. If you are needing high availability, then your should jump to indexer clustering. That’s also give more performance when you have more peers in cluster.  https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Aboutindexesandindexers r. Ismo ... View more

All those are used only feature part of license not ingesting part. You should use central license server to share license to all of your splunk enterprise nodes. You could found more here: https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/TypesofSplunklicenses r. Ismo ... View more

Hi if I recall right there is no option to do that as you want to use second group as fallback address. The Splunk way is to use several host on output stanza or even better if you can use indexer discovery for getting current working indexers. https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/indexerdiscovery r. Ismo ... View more

Hi, Since you are using a default sourcetype syslog which comes with default configuration to extract a host from _raw data. [syslog] pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False category = Operating System description = Output produced by many syslog daemons, as described in RFC3164 by the IETF Path of default config - /opt/splunk/etc/system/default/props.conf ------------------------------------- An upvote would be appreciated if it helps! ... View more

Hi @termcap, answering to your questions: No, buying 50 GBof Splunk and 50 GB of ES you haven't 100 GB you have 50 GB of Splunk and ES. Yes you have to upgrade both the products: Splunk Enterprise and ES; For my knowledge you cannot buy a different value for Splunk and ES; ES Installation requires a training on ES because it has some attentions to use in the installation process, e.g. differently to how you might think, the ES is not installed immediately after Splunk, but first all the TAs must be installed and then the ES. Ciao. Giuseppe ... View more

The issue was that I am working with t2.micro AWS cloud instance with really limited RAM, the search job was causing the RAM requirements to shoot up, which was not a problem because behind the scenes it seems I was using my burstable memory credits. Once I ran out of credit, the OOM killer kicked in and started to kill the Splunkd process that was running the job! Changing the instance type of the Linux machine fixed the issue. ... View more

You can take the exams prior to Architect without the courses. To be pedantic, you must successfully complete the courses, not just buy them. ... View more