You can try using sendCookedData=false as in https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd#Forward_a_subset_of_data ... View more

Hi, do you see anything in the splunkd.log of your peer? anything like "Failed to register with cluster master reason"? ... View more

Are your hot and warm locations on different storage ? Are you buckets large (they can be up to 10GB for auto_large size)? If they are on remote devices (like a network storage), check your upload speed, or if you need smaller buckets, change your defaults. ... View more

There's a couple of things you can do: 1) At search time you can add the following (assuming it's your host field that contains the fully qualified domain name): <base_search> | rex field=host "^(?P<hostname>[^\.]+)" | eval hostname=lower(hostname) Then you can use the new field "hostname" to do your check against your lookup. 2) Otherwise you can define a "calculated field" to extract the value out of the fully qualified domain name field: lower(mvindex(split(host,"."),0)) This assumes that your FQDN is stored under field 'host', and it will grab everything up to the first period as the value for whatever field you define. Hope this helps ... View more

Yes, do it like this: https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Outputsconf#IndexAndForward_Processor ... View more

Will that work with CSV lookups or jsut KSV? I'm diong a pull from Active Directory, dropping it into a CSV file and then creating lookups ... View more

Was able to find the issue...you have to update the commands.conf file for passAuth=true ... View more