From Splunk Wiki

Documentation/Community subjects you'd like covered, a wishlist

• Have you been wondering what the best way is to do something in particular? Add your question to this page.
• Do you know the answer to a question someone has asked here? Make a page and tell us! Refer to Help:Editing and Help:Contribute if you need a little information first.

Open questions

• When to use multiple indexes?
• When to use multiple instances on a single server?
• Security issues
• Moving data
• Updates
• Server management
• How best to configure internal index logrolling?
• Best practices on adding to a summary index (timeframes, how much of an event, etc)
• Anonymization at search-time for particular users
• How to configure a proxy server to run in front of Splunk 4.x?
• Whats the best practice for upgrading in an enterprise environment?