Check your query. https://docs.oracle.com/javase/8/docs/api/index.html?java/lang/StringIndexOutOfBoundsException.html ... View more

Hi @pallabtheartist , The SF and RF is configured on the indexer cluster, which will tell you how many copies of data(buckets) you need to duplicate(RF) and out of that copies how many is searchable(SF). Knowledge objects created in a search head cluster member replicates to other search head cluster members, which means all the knowledge objects which you have created in a search head will replicate to all the other search head cluster members regardless of your SF and RF settings. ... View more

Hi @micheloosterhof , I installed the add-on's on both side and configured the sender IP and port details. But on the receiving indexer where the diode receiver is configured i am getting below error message. ERROR TcpInputProc- Message rejected. Received unexpected message of size=1010053694 bytes from src=x.x.x.x in streaming mode. Maximum message size allowed=67108864. Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. Here, i'm sending traffic to default splunk tcp port 9997. Should i change that to different tcp port or via UDP will be fine? ... View more