UF ---> indexer or  UF---> HF----> indexer   if HF is yes, then, do you have props.conf at HF or indexer or both? ... View more

what add-on you are referring to ? i am also getting same error for deployment server after upgrading from 5.x to 6.x version. ... View more

The key/value pairs haven't been extracted because Splunk extracts automatically only key/value pairs in form: key=value. ... View more

I think you can go for stopping the instances one by one, And then use the rolling-restart command to start all of the peers. I also couldn't find anything about the stopping from master node. ... View more

BUt if you eval on search head it is extremely slow process verse having the indexer only return valid data. I am now trying this with a 7.0.0 universal forwarder and the same issue STILL exists... When is splunk going to fix this obvious mistake? ... View more

Use this ? Come on .. I am new to splunk .. Where to use it ? How ? ... View more

OK, because that's not what it said in your question...anyhow, you shouldn't need to "activate" this anywhere, just restart the Splunk instance and you should be good to go. Possible steps forward is to check btool output ( $SPLUNK_HOME/bin/splunk cmd btool inputs list --debug ) to see if Splunk sees your defined inputs. If it does, you should check splunkd.log to see if there are any problems with the inputs you've defined. ... View more

Or better yet: Since you are running Splunk 6.2, use the Distributed Management Console to monitor your Splunk deployment. Note that as of right now, S.o.S is not certified on search-head clusters. Read more this here. ... View more

The main reason we recommend to run each component of clustering (master, peer, search head) on separate server is because we don't want the failure of one component affects the other and bring down the entire cluster. ... View more

it ll be better if u ll help rather than to argue. :)i did nt get that dats why i asked. ... View more

Thanks a lot! That helped! ... View more