Hello Splunkers / @DavidHourani  We have a single site indexer cluster with 2 Indexers which are having storage issues so we decided to apply below parameters. We are currently on Splunk version 8.1.7 1. tsidxWritingLevel = 4 2. enableTsidxReduction = true 3. timePeriodInSecBeforeTsidxReduction = 7890000 The issue here is from cluster Master i can see RF/SF is not met and 1 of the IDX is in Automatic-detention mode, so in this scenario what challenges will i face if above parameters are enabled for all the existing indexes. Splunk docs doesn't tell much about RF/SF with these parameters. ... View more

I was wondering, 1. We have search time and index time field extractions, so can i push the same props/transforms over SH and indexer cluster for search time field extraction or no need to push the same at indexer since search head will replicate knowledge budle with its search peers. And do i need to restart both search head and the indexers for these conf files to take effect? 2.  For index time field extraction we usually push the props/transforms over HF and do i need to push the same conf over indexers as well. And do i need to restart both HF and the indexers for these conf files to take effect?   ... View more