Hi, I am new to Splunk and I need your guidance. We have Splunk landscape with deployment server, cluster master, 3 indexers and 2 searchheads. Recently we are getting unclassified data into syslog index and as per the requirement they should go to different index. After looking into splunk help, I have updated input.conf in deployment server with the new hosts with the index that are sending data. I need your help on what other steps are required to do this set up and restarting the splunk. One of colleagues suggested to apply bundle(?) to peers and I don't know what does it mean. Do I need to do anything in cluster master? Once done, how and where to do Splunk restart? Please help me with this. Thanks, Ramesh ... View more