I want to offload some logs into MinIO using smartstore to reduce volume consumption in license, but I cannot find reference if smartstore will still count against the license volume ... View more

When logs arrive heavyforwarder, the forwarder may add some metadata into it based on the rule.   For example, 1. I have Syslog forwarder keeps on writing logs into the Heavy forwarder's disk space. 2. Heavyforwarder monitor logs written into various directories, e.g. [monitor:///var/log/remote/source_type_a/*.log] 3. Heavy forwarder add the source_type and host of the log, when it is indexing. E.g. if it is forwarding the log from /var/log/remote/source_type_a/*.log, it add the sourcetype of log as source_type_a   Does these meta data also count into the indexer license limit? ... View more

I want to configure two HEC tokens as the same because I want to load balance traffic between them. I followed the document - https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UseHECusingconffiles,   I edited the /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf: 1. Create new stanza - The name of the stanza is the same as the HEC token name that I want to edit [hec-test1] 2. Under the stanza, specify the new token value for overriding token = xxxxx     After the edit, it does not work. The Splunk even return error: Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf Invalid key in stanza [hec-test1] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 4: token (value: xxxxx). ... View more

I have configured connection between the heavy forwarder and indexer. Also I created a custom index on the indexer. When I configure HEC on the heavy forwarder, I suppose to be able to select index created on the indexer. However, I cannot select the custom index from the heavy forwarder. Would there be any suggestions on properly forwarding HEC logs from heavy forwarder to indexer? Thank you. ... View more