You can use clone_sourcetype to clone your data into another sourcetype. Your will need to configure your props.conf and transforms.conf to look something like this: props.conf [original_sourcetype] parm1 = xxx parm2 = 123 [duplicate_sourcetype] parm1 = xxx parm2 = 123 [source::] TRANSFORMS-clone = clone_sourcetype transforms.conf: [clone_sourcetype] CLONE_SOURCETYPE = duplicate_sourcetype REGEX = . ... View more

Just ran into this issue and found that it was caused by a malformed list of servers in outputs.conf ... View more

Here are the basic steps if you are doing this from the UI (you can also go to the CLI and update authentication.conf): From your search head, go to Settings > Access Controls > Authentication Method Select LDAP and click on Configure Splunk to use LDAP Click New, populate the required fields on the form and save. If the connection to your LDAP host works, your strategy will be saved and you can then click on "Map Groups" to assign Splunk roles to you Active Directory groups. ... View more

If your system can handle the load, you can increase your max_searches_per_cpu. I had an old instance where we had it at 6 on search heads with 12 core CPUs. ... View more