@SanjayReddy it changes the Client name but not the Hostname in the Forwarder Management. ... View more

Thanks for your response. I found in this documentation the following: * The Splunk platform always uses the higher value for either setting to enforce index-time field extraction limits.  *If you set 'indexed_kv_limit' to "200" and 'limit' to "500", then the platform limits both index-time and search-time field extraction to 500. So it means that if I increase the 'limit' value via ACS ( which seems to be possible) then the 'indexed_kv_limit' value will increase as well right? Also, can I increase this value in a ITSI SH using ACS? I appreciate any insight. Thanks. ... View more

@richgalloway How can I double-check if my SHs share indexers? Thanks in advance! ... View more

@johnhuang I'm a bit of a novice at this. What can be an example of a query that I should execute from the SHC to see that data from the ES SH in that summary index? ... View more

Hi @johnhuang What about if I create a summary index with that data on the ES SH and I try to search it from the SHC? is that possible? ... View more

Hi @richgalloway I already tried with | rest /servicesNS/-/-/admin/users as well but I got the same result even using the admin_all_objects capability. ... View more

@richgalloway  @ryanJustRyan  Thanks for your reply. Just another quick noob question: I have the following configuration on Splunk UF inputs:  [monitor:///apps/syslog-ng/.../port_30001/...) When a use telnet localhost 30001 it says "Connection refused" and because of that, the logs are not being sent to my indexers. I should open the port on my network side? I used ss -antp | grep '30001' and port is not listening on my machine. Thanks. ... View more

Very interesting information. I appreciate it. ... View more

@drich Just a quick question: Can those flags be modified after the UF installation? Or how can I verify the current options of those flags? Thanks in advance, ... View more

Hi @gcusello, Yes I want to send all logs to both instances.   This is the configuration of the both apps. I already tried to connect both stacks to my HF but once I enable the second one then the first one stops sending data.   [splunk@ip-10-202-xx-x apps]$ btool outputs list --debug | grep yyyy* /opt/splunk/etc/apps/yyyy.splunkcloud/local/outputs.conf   channelReapInterval = 60000 /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   channelReapLowater = 10 /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   channelTTL = 300000 /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   dnsResolutionInterval = 300 /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   negotiateNewProtocol = true /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   polling_interval = 5 /opt/splunk/etc/apps/yyyyy.splunkcloud/local/outputs.conf   socksResolveDNS = false /opt/splunk/etc/apps/yyyyyy.splunkcloud/default/outputs.conf [tcpout:splunkcloud_20220701_9aaa4b04216cd9a0a4dc1eb274307fd1] /opt/splunk/etc/apps/yyyyy.splunkcloud/default/outputs.conf autoLBFrequency = 120 /opt/splunk/etc/apps/yyyyy.splunkcloud/default/outputs.conf clientCert = $SPLUNK_HOME/etc/apps/yyyy.splunkcloud/default/yyyy._server.pem /opt/splunk/etc/apps/yyyy.splunkcloud/default/outputs.conf compressed = false /opt/splunk/etc/apps/yyyyy.splunkcloud/default/outputs.conf server = yyyyy.splunkcloud.com:9997 /opt/splunk/etc/apps/yyyyy.splunkcloud/default/outputs.conf sslCommonNameToCheck = *.yyyyyy.splunkcloud.com /opt/splunk/etc/apps/yyyyy.splunkcloud/default/outputs.conf sslVerifyServerCert = true /opt/splunk/etc/apps/yyyyyy.splunkcloud/default/outputs.conf useClientSSLCompression = true   [splunk@ip-10-202-xx-x apps]$ btool outputs list --debug | grep xxx* /opt/splunk/etc/apps/xxxxx.splunkcloud/local/outputs.conf    [tcpout] /opt/splunk/etc/apps/xxx_splunkcloud/default/outputs.conf  defaultGroup = splunkcloud_20220420_9aaa4b04216cd9a0a4dc1eb274307fd1 /opt/splunk/etc/apps/xxxxxx.splunkcloud/local/outputs.conf    sslPassword = $7$ycs8Ky2NJ7C6ac5cli3WDMYUhJ8c0AGzYcvs98ClgTbMKHAyLn3b/tiFEna/KXUXy9Cwx7CKZWp3Io0gypPEzmsHK2Wc9U7fhm0qjwx /opt/splunk/etc/apps/xxx.splunkcloud/default/outputs.conf  useACK = true /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  [tcpout:sxs] /opt/splunk/etc/apps/xxx.splunkcloud/default/outputs.conf  autoLBFrequency = 120 /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  clientCert = $SPLUNK_HOME/etc/apps/xxxx.splunkcloud/default/xxxx.server.pem /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  compressed = true /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  disabled = 1 /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  server = xxxx..forwarders.sxs.splunk.com:9997 /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  sslAltNameToCheck = *.forwarders.sxs.splunk.com /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  sslVerifyServerCert = true /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  useClientSSLCompression = false /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  [tcpout:splunkcloud_20220420_9aaa4b04216cd9a0a4dc1eb27430] /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  autoLBFrequency = 120 /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  clientCert = $SPLUNK_HOME/etc/apps/xxxxx.splunkcloud/default/xxxx.server.pem /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  compressed = false /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  server = inputs1.xxxx..splunkcloud.com:9997, inputs2.xxxxx..splunkcloud.com:9997, etc.. /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  sslCommonNameToCheck = *.xxxx.splunkcloud.com /opt/splunk/etc/apps/xxxx.splunkcloud/default/outputs.conf  sslVerifyServerCert = true /opt/splunk/etc/apps/xxxxx.splunkcloud/default/outputs.conf  useClientSSLCompression = true   I appreciate your help. Thanks. ... View more