Do you have Splunk UF's that are running in a load-balanced manner and/or ingesting other host data (ie. central syslog server)? Take advantage of Splunk's built-in meta tagging. This meta tag can be used with multiple key::value definitions. Navigate to ~/etc/system/local within

Do you have a large amount of HF tiers or data coming in through other mechanisms? This will help troubleshoot where that data was "cooked" by Splunk. We will build a simple Splunk add-on app that you can deploy on Heavy Forwarder's and it will simply