Hi Kristian.kolb, Your point made sense and now i have almost distributed data across all indexers in random fashion. Will again index the data on 8 indexers and hopefully that will sort out my problem. Thanks for the big big help. Mehal ... View more

not to indexes.conf but i have added can delete role in admin.. Also my data is of 1987. so timestamp is of 1987 when indexed. ... View more

Year is 4 digits long. example 1999 quarter is 1 digit long. example 3 month is max 2 digits long example 12 or 4 dayofmonth is max 2 digits long example 5 or 23 CRSdeptTime is 4 digits long example 0930 [09 hours 30 min] ... View more

from the search view ( flashtimeline ) you can search with index=_internal and search for some of yours files as search arguments (probably using wildcards to make things easier) ... View more

Yes, I tried following that but doesn't helping me much. I did below to inputs.conf and outputs.conf files : In SplunkForwarder: I edited outputs.conf with following [monitor://mnt/cloudstorage/unzipped_data] _TCP_ROUTING = * index = _internal sourcetype=airtime_csv edited inputs.conf with following [tcpout:splunkindexer] server = ipaddress:9997 In Splunk: I edited outputs.conf with following Edited inputs.conf with below [splunktcp:9997] and nothing for outputs.conf But not working out.Also do we change above files in /etc/system/local directory or /etc/system/default directory ? ... View more