My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well The first HF sends to other HF but is not indexed and the UF attached to HF1 is not showing up at all    is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER  ... View more

How do I configure deployment server where I have a main or master server that has apps it pushes to its clients and will push to a secondary server behind a firewall.   Then that server pushes apps  to its set of clients Clients... ... View more

every night my Server Crashes saying out of memory error however I have more than enough memory. In event logs get a : Unable to allocate dynamic memory buffer ,and Faulting application name: splunkd  faulting module name: Ucrtbase.dll   Systems log has a low memory condition  looks like Splunk has a memory leak so how do i find out what is causing it ?       ... View more

I am setting _meta at the app level can i also set it in the /system/local or will one override the other   For example /myapp/inputs _meta name::bill  /system/local/inputs _meta last::dave so then the indexer would get both bill and dave ... View more

I need to Forward All Windows Security/Application/system logs to 2 Separate Splunk instances with different Index names.   so  Security log ------- Index1 on serverA , Index2 on ServerB   in my Input.cof on my UF do i use Index=index1,Index2 Then in Output of HF send to Index_servers= ServerA/ServerB I need to make sure ServerB does not get hit with Index1      ... View more