Hi all, Ill try and keep it short and to the point.  We have a standalone search head that is currently connected to an index cluster with 4 peers. We would now like to connect a second 3 peer index cluster that is hosted in AWS. When I add the AWS cluster master to the search head via Settings -> Indexer Clustering it actually fails to connect due to the below error: Master has multisite enabled but the search head is missing the 'multisite' attribute' but if I configure in the server.conf file and reboot, the AWS cluster master connects fine but the 3 peers do not appear as per below screenshot and I am not able to search the indexes.     If I manually add the index peers under Settings -> Distributed Search -> New Search Peer, the peers add fine and I am able to search indexes in AWS as required.  I need the peers to be discovered automatically by the search head via the cluster master as the AWS indexers are rebuilt on a regular basis. Below is the server.conf on our search head and I have been informed that autodiscovery is enabled on the AWS Cluster master. I have logged a case with Splunk but thought I would try here as well. Any information would be appreciated Thanks   Trev ... View more

Hi all, I am running a Splunk 7.3.0 distributed / clustered environment and I have noticed that the DMC is reporting that disk usage on my indexers is high ie around the 85% mark, however Windows Server 2016 says that it is around 65% as per attached screenshot. Its mainly the F drive as far as I can tell. Disk usage was high previously however I then implemented retention policies on the indexes which cleared out a large amount of data, is it possible the DMC is caching an old value and is not updating ? I have restarted the Cluster master node and we have rebooted the index cluster since then I believe.   Any info would be great,   Thanks  ... View more

Hey all, Long story short, I have a Windows IIS FTP server on a Heavy forwarder that receives logs from Cisco proxy servers  and I am monitoring the FTP folders that contain Cisco proxy logs. I am having a problem whereby the logs uploaded to the FTP server have an owner of ciscoftp and Splunk is unable to read the files with this owner. If I set the file owner to administrators, Splunk is able to read and ingest the logs as required. Splunk is running as a local system account and I have granted "Everyone" full control of the folder for testing purposes but as long as the file owner is set to ciscoftp (a local user account) then Splunk is unable to read the file. I have another folder full of Cisco ESA logs and the file owner is set to administrator by default and Splunk is able to read these files out of the box. My issue is two-fold, 1) how to set the file owner to administrators by default and/or 2) how do I get Splunk to read files created by ciscoftp user? At this stage, it looks like I may need a script to set the permissions on the file on a periodic basis, which I don't really want to do. Has anyone experienced a similar issue? Any help would be awesome. Thanks, Trev ... View more