We started seeing this recently as well.  Also the various S1 Splunk integrations do not understand or permit having the IA and App on the same instance so Victoria experience doesn't work properly.  This is also the case for the various scalyr dataset add ons, cannot create inputs because it complains about being on a search head.   ... View more

Seems like a glaring omission and no answer in 9 months.   ... View more

I didn't see any info about parsing these logs. Mine are sending as syslog but nothing is parsed and it's all XML formatted. Did you chose something other than syslog or create a parser?   ... View more