Best practice is to create an app, call it (your_company_name)_all_indexers or something to that effect, create a default subdirectory and in there populate an app.conf (requirement for Splunk Cloud in particular for versioning) and a props.conf. Splunk best practice is to create apps with the name of the authoring organization and the app's target component in the infrastructure (can be a Splunk tier, a particular source, etc etc). In this case I chose "all_indexers" as the target tier. In the props.conf put the TRUNCATE=(some #>10000) in the stanzas you create per the Splunk documentation for props (Google Splunk props.conf.spec). Then, submit it for distribution to your indexers from the cluster master. ... View more

Here's the Splunk doc for it: https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/UseHECfromtheCLI ... View more

Did you ever manage to get this setup working? I have a need to do a logs-to-metrics for *nix TA output and any shortcuts would be appreciated. ... View more

I'd like to mention that the latest documentation also requests to install this TA on the search head cluster - http://docs.splunk.com/Documentation/AddOns/released/VMW/Install From the install guide: Upload the Splunk Add-on for VMware to your search heads Stop your Splunk platform instance. If using a search head cluster, upload SA-Hydra, SA-VMNetAppUtils, Splunk_TA_esxilogs, Splunk_TA_vcenter, and Splunk_TA_vmware to opt/splunk/etc/shcluster/apps/ on the deployer. In SHC this also produces numerous errors regarding the inability to initialize the modular input. Removal of the inputs.conf and inputs.conf.spec solves this as well. ... View more

See: https://answers.splunk.com/answers/188469/how-to-get-results-to-load-with-a-time-picker-sett.html ... View more

This could be a great way to keep eg forwarders up to date if not the search head/indexers. ... View more