Hello. If our Enterprise Splunk license expired and we disabled our ingest, so no license violations were received, would Splunk historical data still be fully searchable, WITHOUT applying free license or applying another Enterprise license? Thanks, ... View more

We are currently running Splunk Enterprise, on-prem on a Linux VM and have a search head, with several forwarders. How can we maintain the search functionality for historical log data, but stop/disable logging of any new data, either a blanket stop for all hosts/forwarders, or individually? I think this can be done in the .conf file somehow? Is there an easier way to do this? Our Splunk System Admin has left our company and I am trying to get up to speed on how this would be done. Thanks,   ... View more

When looking to update a deployment enterprise instances, we are exploring using a deployment server. Splunk documentation says the below: "When provisioning a deployment server, note the following: If it will be deploying to more than 50 clients, the deployment server must run on a dedicated Splunk Enterprise instance. The instance cannot double as an indexer or search head." Is this below command the way to view the number of clients? If so, I have 46, but I am looking to confirm, to see if we need to use a dedicated Splunk enterprise instance for updating using a deployment server.       index=_internal source=*metrics.log group=tcpin_connections splunk_server=* | eval host=if(isnull(hostname), sourceHost,hostname) | search (host=*) AND (host!="(ALL)") | eval connectionType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk fwder", connectionType=="raw" or connectionType=="rawSSL","legacy fwder") | eval Ver=if(isnull(version),"pre 4.2",version) | fields connectionType sourceIp host kb tcp_eps tcp_KBps splunk_server Ver | stats min(_time) as first_time, max(_time) as last_time, max(tcp_KBps) as max_tcp_KBps, avg(tcp_KBps) as avg_tcp_KBps, avg(tcp_eps) as avg_tcp_eps, sum(kb) as sum_kb by host sourceIp Ver | dedup host | eval sum_mb = round(sum_kb/1024,0) | fields - sum_kb | eval avg_tcp_KBps = round(avg_tcp_KBps,0) | eval max_tcp_KBps = round(max_tcp_KBps,0) | eval class=case( avg_tcp_KBps>0 AND avg_tcp_KBps<=128, "Standard Hosts", avg_tcp_KBps>128 AND avg_tcp_KBps<=256, "Better Hosts", avg_tcp_KBps>256, "Special Hosts") | convert ctime(*time) | rename first_time as "First seen", last_time as "Last seen", avg_tcp_KBps as "AVG KB/s", avg_tcp_eps as "AVG Events/s per 30 seconds", sum_mb as "Total MB", max_tcp_KBps as "Peak Kbps" connectionType AS "Forwarder Type" sourceIp as "Source IP" host AS "Host" Ver As "Splunk Version" | sort - "Peak Kbps"     ... View more