Here is the line I added to the props on the index cluster EVAL-destination_protocol=case(dst_port == 443, "https", dst_port == 80, "http") The destination field never makes it to the event. ... View more

Hi nbayko, Setting replication factor depends on many factors. is yours a multi-site or are you running it as a single site cluster? how many sites involved in the cluster. What is your high-availability requirements? With a replication_factor=3 with 2 sites (origin:2, total:3) seems like working fine in many cases as it provides site level HA and this is just an example. Increasing replication factor also comes with the cost of storage. So you need to check and validate your requirements with the settings you have. For the detailed analysis on multi-site and how the replication_factor setting comes into an action, you can refer to the below link. http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Sitereplicationfactor ... View more