I am testing Splunk Cloud DDSS to AWS S3 buckets currently. I see logs in my S3 bucket once an index gets rolled over to S3 after its "Searchable Retention" period ends. The question I have is the logs that I see in S3 buckets are compressed using ".zst". Is this a configuration from Splunk or AWS - is there a way to change it to "gzip". Can we not have logs in its default extension and gzip it accordingly.   My next step is to test the restore process and it requires a standalone Splunk Enterprise instance. How should I go about that, one indexer and one search head, assuming it will be for one index only?   Thank you ... View more

I am trying to correlate authentication attempts [ index_A (username, role) vs index_B (username, authentication_time) ] I want users returned from index_A who dont show up in index_B over last certain number of days (ex. 14 days) To word it better, unique fields from index_A (which live in index_A) which can show up in index_B but I want to list the ones that dont show up  My current solutions is piping a search between the 2 indexes over a "username" field but that lists all the matching items and not unique items from index_A which are not in index_B  ... View more

Architecture: Distributed - Deployment Server pushes changes to forwarders (1 hvyfwd, 2 universal) - Clustered indexers,  there is a cluster master    I made a change in inputs.conf file stanza to edit IP address and hostname for one of the logsources. I tried to push that change to forwarders through restarting the server class on deployment server gui. However, I am unable to see those logs come in from that IP and source name.  Is there a step that I am missing? ... View more