The wiki page describes how you can install multiple versions on windows. (Note that it is annoying, as the MSI installer installs a service and doesn't give you much choice about it.) There's no reason you couldn't install different versions as your additional installations though. ... View more

[Update] It appears this only affects installations running the Enterprise Trial license. If you still think this is un-Splunk-like behavior, please upvote to send that message! -- Yes, you can disable it. What you are seeing is a message from the Splunk upgrade checker tool which, oddly, now has a message from Splunk Marketing. You can get more information about the checker here and turn it off following the advice in this answer. Add the updateCheckerBaseURL = 0 under [settings] in a web.conf . I advise putting the web.conf in an app if you are deploying other settings via an app. You can also put it in etc/system/local . ... View more

Yes, Splunk can. You can use SEDCMD- to rewrite the events to remove the \x00 s, which by the time the data hits an indexer are already the text "\x00" - they're no longer the null byte. On the search bar: | rex mode=sed "s/\\\\x00//g" Automatically at parsing ("indexing") time for any new data, in props.conf: [yoursourcetype] SEDCMD-remove_nulls = s/\\x00//g LINE_BREAKER = ((?:[\r\n](?:\\x00)?)+) Special LINE_BREAKER was added because Splunk was interpreting the null bytes between \r and \n (the two halves of the Windows newline, in the file I was working on) as additional lines and adding them to the event. It says use " (one newline character optionally followed by the text \ x 0 0) one or more times " as the breaker (thrown away) between events. ... View more