We are generating HEC tokens on a deployment server and pushing them out to the HECs.  HEC tokens are disabled by default on the HECs and the deployment server and need to be enabled in global settings.  What I've done so far is: -authorize.conf, this is for user tokens and isn't working for HEC tokens -the CLI command for token enable isn't working because it's not enabled globally -inputs.conf has [http] disabled=0   The only thing that has worked is enabling it via the UI. Is there a way to enable these over CLI? ... View more

If I have 6 search peers configured in the distsearch.conf file but 3 of them go down, can Splunk recognize that a host is down and continue skipping down the list until it gets a live host? ... View more

Currently working on deploying Splunk on AWS to work in conjunction with our current on-prem solution and I have 2 questions. Can I configure our AWS Search heads to function as normal Search Heads AND as search peers for our on-prem solution? Or would I need dedicated search peers? And would I be able to place the Search peers behind a NLB and point the on-prem distconf file to that NLB? Or would I have to hardcode the instances in the distconf file?  ... View more