By default, the forwarders will switch to a different indexer (randomly) every 30 seconds, or when EOF is reached on a monitored file. There are situations where you want to tune that, specifically if you notice an uneven event distribution across your three indexers. Having a good distribution of events across your indexing tier is ensuring optimal search performance. Take a look here for more details on each of the outputs.conf settings. ... View more

Got it working!! I had forgotten to restart the Universal Forwarders. I thought that pushing the configuration files to them was sufficient. Thanks for your help, woodcock. Slowly but surely, you're getting all of my coins 🙂 ... View more

did you get the filtering to work? i have the same issue, i.e. even REGEX=. didn't filter anything out thanks, ... View more

If we have too many sourcetypes, say around in 1600 in props.conf, does it affects the indexing & search performance ? If yes, it would be great if you could help me understand the logic behind it . Thanks in Advance !! ... View more

Thanks! Just what I needed. ... View more

I think that we were correct in assuming they should be on the Heavy Forwarder, since I want the Heavy Forwarder to lessen the amount of data being sent to the Indexer (aka filtering). And I give the change ample to take effect, but still sometimes the changes don't seem to have an effect. ... View more

Generally the apps that start with TA (enabling Technology Add-ons ) are supposed to be run on forwards so maybe you just do those. ... View more

Yes, you would have to make your own "app" and push it out to your Universal forwarders using deployment-apps. http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Createdeploymentapps ... View more

I did this, and the new server is listed as the tcp-out. However, it isn't receiving anything yet, and my old server is still constantly getting new data. ... View more

The answer above didn't help me when I found it via Google. A Stackoverflow answer led me in the right direction. powershell -noexit "& ""C:\my_path\yada_yada\run_import_script.ps1""" http://stackoverflow.com/questions/2035193/how-to-run-a-powershell-script Referencing the path to Powershell is usually unnecessary. Using a variable for the Splunk install location also might be unnecessary. Regardless of a 32/64 bit installation, it should always bee under C:\Program Files . As for drive letter, the average user doesn't install programs to drives other than where Windows is installed, and Windows is almost always installed on C: . ... View more

Sorry, refresh it. 🙂 ... View more

The serverclass lets you specify whitelist and blacklist for incoming connections. Without one of these set, your Search Head is not a DS . ... View more

I changed that now, so that it is [monitor://c:...*.txt] and still no luck. ... View more