host, index, source_length, _TCP_Routing, host_segment

host, index, sourcetype, _TCP_Routing, host_regex, host_segment

host, index, directory, host_regex, host_segment

host, index, sourcetype, _UDP_Routing, host_regex, host_segment

Availability of premium apps, no IP address whitelisting or blacklisting, deployed in US East AWS region.

20GB daily maximum data ingestion, no SSO integration, no availability of premium apps.

Availability of premium apps, SSO integration, IP address whitelisting and blacklisting.

Availability of premium apps, SSO integration, maximum concurrent search limit of 20.

This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app.

The configuration changes can be made using CLI, directly in configuration files, or via a deployment app.

It is only possible to make this change directly in configuration files or via a deployment app.

Pauses a file monitor if the queue is full.

Only creates a tail checkpoint of the monitored file.

Ingests a file starting with new content and then reading older events.

Prevents pre-existing content in a file from being ingested.

The party requesting the change.

Certified Splunk Cloud administrator.

Splunk infrastructure owner.

Any person with the appropriate entitlement.