At 9.0.1 it gives that actions as earlier index=_audit action=login* earliest=-4h | stats count by action   ... View more

Yes.  The --enforce-counts option tells the CM to make sure the RF and SF counts are satisfied before the indexer shuts down. See https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Takeapeeroffline#Take_a_peer_down_permanently:_the_enforce-counts_offline_command and https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Whathappenswhenapeergoesdown#When_a_peer_node_gets_taken_offline_intentionally . ... View more

I would suggest upgrading these servers if possible. But if that's impossible, I would look into setting up Windows Event Forwarding, so that these 2003 and 2008 servers send their logs to a different windows machine running a later version of windows, which then indexes the events into Splunk. You may have to set up the following Stanzas in your cluster master and deployment server apps so that Splunk knows to re-write the host field so that it reflects the 2003 and 2008 servers rather than the collector server: # in inputs.conf in deployment server app [WinEventLog://ForwardedEvents] disabled = 0 sourcetype=XmlWinEventLog:ForwardedEvents host=WinEventLogForwardHost index = forward_event_index # in props.conf in cluster master app [host::WinEventLogForwardHost] TRANSFORMS-change_host_windows = WinEventHostOverride # in transforms.conf in cluster master app [WinEventHostOverride] DEST_KEY = MetaData:Host REGEX=<Computer>([^.<]+).*?<\/Computer> FORMAT = host::$1   ... View more