Given this in outputs.conf: [tcpout: my_LB_indexers] server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995 It states in the documentation that "The universal forwarder will load balance between the three receivers listed. If one receiver goes down, the forwarder automatically switches to another one on the list." Question is, what if 10.10.10.1:9997 is always up, does that mean it wont send the data to the other two indexers? and only then will it change indexer, once 10.10.10.1:9997 is down? Or it distributes the data to all three indexers regardless if one is up/down? ... View more

Our present architecture now is single indexer, and multiple universal forwarders; However, it's getting slower when we have multiple panels and multiple search strings. Wondering if the solution is to have multiple indexers? ... View more

I have a forwarder that forwards data every 60 seconds. I would like to know the count when the forwarder is down (means there's no network and/or the machine is off/no power) ... View more

How to have a search that returns a table if the value of a specific field is X, else, it shouldn't be shown. Name......Value A..............3 B..............5 C..............20 IF: Value > 10 Name.....Value C.............20 ... View more

Given that I have my latitude an longitude in an RDBMS and I can access it using Splunk DB Connect. I want to show the Physical address based on the latitude and longitude cordinates ... View more