Interesting. Didn't expect that. But be aware that since you're most probably not using static public IPs on your Splunk components you'd be opening relaying from whatever is NAT-ed to the same IP. ... View more

@sivaranjiniG , have you defined props and transforms under the search app context? Or if you created a new app, did you check the permission for app where you have defined props and transforms? can they be used in app context search or globally? (This can be validated in Splunk by going to Manage Apps (looking for sharing attribute) and searching for the custom app (if that's the case)) I was curious to know, have your tried removing "FORMAT = " (by default it should be considered an empty string)   ... View more

I know, I was lucky to get individual certs for each splunk box. We're going with one cert for all forwarders. ... View more