Hey Splunk Gurus, One quick question, is there any way to ship out all the splunk data from its indexers to aws s3 buckets? Environment is splunk cloud. Appreciate your response. Thanks Abhi ... View more

Hello Splunkers, I am ingesting data from azure eventhub, and after using some SEDCMDs in my props, I am making data into json. However, I see multiple entries of same data. apart from SEDMDs my props is as below: HF pulldown_type = true KV_MODE=none   Searchhead pulldown_type = true INDEXED_EXTRACTIONS=json KV_MODE=none   Can you please help what mistake i am doing here?   Thanks ... View more