We have a requirement to send audit logs from Splunk to Another tool for security purpose. asked to install the UF on where the audit logs stored to forward the logs to their end. I would like to know if it is possible to install UF on one of our indexer (where the audit logs stored location /opt/splunk/var/log/splunk). Please let me know if anyone has any experience working on similar requirement/task.  Thanks in advance! ... View more

Hi, - We are currently having Splunk On-prem with single site (Site A) Version: 7.3.4     10 Indexers, 5 SH's, 2 DS, 2 HF's, CM, DMC, LM (Distributed Clustered) - We have recently build another site  (Site B) Version 9.0.1    10 Indexers, 4 SH's, 2 DS, 2 HF's, CM, DMC, LM (Distributed Clustered) I have few below questions How can we transfer/move the entire data from our Site A to our new site B? What is the order to follow? what are the Pre-Req's? What would be the expected down time for this migration process? is there any clear implementation documentation/steps? Thanks in advance and your help would be highly appreciate! ... View more