Hi @Jnewman28, You should be able to access via GUI to your Indexers. You can find the Receiving configuration at [Settings -- Forwarding and Receiving -- Receiving]. You indexers are called splunk-idx-c1.hfelocal.corp, splunk-idx-c2.hfelocal.corp, splunk-idx-c3.hfelocal.corp. Ciao. Giuseppe   ... View more

Hi @Jnewman28, So, when a Splunk Enterprise License expires, you must downgrade to a Free license, the only other choice is to buy a new license! As I said: using a free license some features are disabled (e.g. login, alerts, distributed search, etc...) as you can see at https://www.splunk.com/view/SP-CAAAE66 in addition you have the limit of 500 MB/day and 3 exceedings of the above limit. So if you don't index other data, you can continue to search in all the indexed data until you have these data in your indexes (for this reason I spoke of retention!). Beware: you don't have login credentials in the Free version, only in the licensed version! Tell me if I can help you more, or, please, accept the answer for the other people of Community. Ciao. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Co-locating the DS and CM is something you may be able to get away with, but it's not a good practice.  As the Splunk environment grows and becomes busier, the DS and CM will compete for resources and the indexer cluster will suffer for it.  See "Management / Utility Tier Recommendations" in the Splunk Validated Architectures manual (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf) ... View more