In my indexers inputs.conf we have the standard stanza in place for receiving inbound logs from forwarders. [splunktcp://9997] disabled = 0 Am I able to add additional stanza(s) to the inputs.conf so I can properly identify and index logs that are being sent via syslog to the indexer (due to the logs belonging to SaaS or an appliance and can't have a forwarder installed) i.e. [tcp://10.1.1.1:9997] index=windows source=10.1.1.1 Thanks ... View more

I am currently restructuring our logging architecture and want to move existing cold data to hot data but wanted to ensure this was possible or if anything special was required other than a simple move from one directory to the next. Thanks! ... View more

I have googled and searched my little heart out, but I am unsure if I am querying using best practice or if this would even work. But here is what I am trying to do: Use case example: AV alert logs to one index, with identifiable field "Computer_Name" then ensure "src_host" field matches "Computer_Name" in another index and then stats various fields within each index. index=index2 sourcetype=irrelevant2 category!=Other | fields Computer_Name, field, field [search index=index1 ind_primary_user_business_unit=irrelevant | fields src_host, field, field, field, field, field, field] | eval host=coalesce(src_host,Computer_Name) |stats count by host, field from index 1, field from index 1,field from index 2, field from index 2, field from index 2, field from index 2, field from index 2, field from index 2 Thanks as always ... View more