And you really think this is a common use case? I use windows at home in a VM with a GPU passthrough but I don't say that it's something used at a typical desktop. ... View more

Hi @andynewsoncap, you can find the daily size of an index using the License Consuption Report . the compression factor is usually around 50%, but a more detailed calculation is the one I shared, from the Splunk Architect Course. total_disk_space = daily_indexing * (0.15 * RF + 0.35 * SF) * retention obviously, this is the total required storage for a cluster, to have the storage required for each Indexer of a cluster you have to divide by the number of Indexers of the Cluster. Ciao. Giuseppe ... View more

Typically you'd use an external infrastructure monitoring solution (like Nagios/Zabbix/whatever) to check the difference between host's time and a known reliable time source. The idea of monitoring time is always tricky. Especially with splunk where everything is time related and you can't trust the server's time to... monitor the server's time 🙂 So you either have to check the server's reported time and verify it with an external reliable source (but you can't report it using simply timestamps on events since events have unknown delay; so you'd need another way to query them near real-time) or have the servers themselves query a reliable time source and report their findings along with their own timestamp. But tha boils down to querying a remote NTP which is what I understand is failing in your case. ... View more

I not saying this fixed it. but this made it go away for now. I set on the CM ./splunk edit cluster-config -max_peer_build_load 8 ./splunk edit cluster-config -max_peer_rep_load 20 I put the CM into maint mode. And on the indexer I set  max_replication_errors to 10 from 3 I then rebooted each indexer just to get them as clean as possible.  Once I had rebooted each Index and all where up and working.  I restart the CM and took it out of Maint mode.  After about 3 hours is sorted itself.  then i reset back to the original values.. ... View more