With HF - it can be complicated because the problem here typically would be not to have multiple instances but to _not_ have multiple input instances running at the same time and you'd need to replicate the state of the inputs in case of a need for fail-over. There is nothing out-of-the-box to do it. You can to devise something with zip ties and duct tape but those solutions typically have some issues specific to chosen architecture. Of course if you're not running any scripted/modular inputs and only have HFs as a "parsing layer" in front of indexes, there is no problem with having multiple HFs receiving data from UFs. With SC4S there is no problem with running multiple instances. The problem is that you want the sources to send only to one of them. You can try to do some tricks with "floating IP" either on the hosts themselves using keepalived or something similar or on the router using some form of network-level load-balancing but it doesn't give you 100% guarantee of no data loss during the switchover period. It's just how the syslog works. ... View more

Please tell us more about how the syslog data gets from the Solaris servers to Splunk. How are you trying to search for the logs?  What query are you using?  Are you sure you have the index correct?  Have you tried different time ranges (Including the future)? ... View more

Hi @sonishar, as I already answered and also @isoutamo and @chaker said: as you can read at https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install, you have to install this TA on the Search Heads for the search time parsing activities, but also on Indexers (for the indexes) and Heavy Forwarders (if present) and especially on the universal Forwarders where the logs are written. Probably this is the reason of the invalid directory, because the TA doesn't find the IIS folder. Ciao. Giuseppe ... View more

Thank you so much @gcusello  i understood, will be raising new request ... View more

i wanted to get below logs from sql server. who has accessed the database recently - what change has been made on the database recently - which new user has been created on the DB recently   Splunk Add-on for Microsoft SQL Server : do not give above logs. Please suggest ... View more