Hi there, We have an instance running already on windows server, I am planning to move our Frozen bucket location from a local drive to a share on another server, I just have a few questions regarding this. Is it as simple as editing the frozen locations on the indexes on the GUI for this and will a UNC path work ok if the permissions are set or must it be a mapped local drive? Thanks in advance! ... View more

Hi there, I am planning to move our Frozen bucket location from a local drive to a share on another server, I just have a few questions regarding this. Is it as simple as editing the indexes for this and will a UNC path work ok if the permissions are set or must it be a mapped local drive? Thanks in advance!     ... View more

Hi folks, I am seeking some assistance with the formatting of forwarded splunk data to a 3rd party collector, we have managed to get everything forwarding fine by configuring C:\Program Files\Splunk\etc\system\local\outputs.conf [syslog] defaultGroup=syslogGroup maxEventSize = 65535 [syslog:syslogGroup] server = IPAddress:514 type = tcp   The problem is that all (windows logs only) we get every field of a log as a separate event that multiplies traffic drastically. I read briefly about line breaking but not sure how to configure this and we only have a live environment and wouldn’t want to make any changes that could potentially break our existing Splunk instance as it’s used heavily by all our I.T departments.   Any advice would be appreciated.   Cheers! ... View more