Having indexes.conf on other components is actually a good practice. It allows you to have working completion in SPL editor dialog and allows for working index choice dialogs on HFs (for some inputs it's mandatory to have those entries, otherwise you're not able to create inputs since you can't choose "non-existing" indexes in GUI and can't save inputs.conf stanza without properly validating the input in GUI). ... View more

Hello! Author of 5498 here!  If you would please elaborate, what do you mean by "encountered limitations related to the number of API requests" ? Which sourcetypes? which inputs? What are the interval settings? Please let me know so I can continue to improve the product. Thank you!   ... View more

I think I used the wrong terms. To clarify: I have distributed Splunk env. with clustered Indexers ... View more

https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Outputsconf There are many options available in the outputs.conf.spec sheet.  You can start setting queue and buffers but be cautious that data in queues and buffers can age out and risk no ingestion. The other thing is try setting compression to reduce the network traffic demands but it will increase the CPU demands on source and destination so make sure that you have cycles to spare. ... View more