I'm having a similar issue with UF 7.0.2 and Windows Server 2012 R2. Except instead of splunk-optimize.exe, I'm having issues with splunk-winevtlog.exe and splunk-perfmon.exe. I'm running SCEP for AV and the machine is an IIS server. AV Definition updates and the IIS worker process w3wp.exe are secondary suspects for us. ... View more

Here's an example entry for a Data Input configured in an inputs.conf file. [web_ping://CNN] index = website_monitoring interval = 1 source = CNN title = CNN url = http://www.cnn.com/ user_agent = Splunk Website Monitoring (+https://splunkbase.splunk.com/app/1493/) ... View more

When you configure the Data Inputs for your monitored sites, check the box for 'More settings' and you'll be able to select the destination index of your choosing. This is for each input/site that you add. Depending on your environment, you may also want to edit the searches on the built in dashboards to start with index=index_name if you change from the default. You can use the app on all your SH's, but you'll want to configure the inputs on just 1 server. Only one needs to send data to your indexer(s). All of them can view it. ... View more