After re-reading the documentation several times over AND piecing together other info from Answers, I think this may be a slightly less complex than what I originally thought. From what I gather, you don't actually need a Hadoop cluster in place to implement Hadoop Data Roll. You need to install the Hadoop client version 2.6 or better and Java version 1.4 or better on the Splunk indexer/search head. Once installed, there are configuration options in the Splunk Web UI to setup index archiving with prewritten scripts that can backup to either a Hadoop cluster HDFS or Amazon S3 bucket, as seen here, https://docs.splunk.com/Documentation/Hunk/6.4.8/Hunk/ArchiveSplunkindexes. ... View more

I've verified that the ports are open between the forwarder & indexer. When I tested the SSL certificate it just returned that a self-signed certificate was in the chain, I don't think it was an error per se. I was finally able to see some traffic within the metrics log, but only after I reverted back to the original default SSL certificates. The problem is, 1) the default SSL certificates are not secure and 2) I'm still not see any data forwarded from other inputs that I've deployed via Splunk_TA_windows. ... View more