diff --git a/.metadata b/.metadata
new file mode 100644
index 0000000..fdd1b78
--- /dev/null
+++ b/.metadata
@@ -0,0 +1 @@
+language_type: cloudformation
diff --git a/.taskcat.yml b/.taskcat.yml
index 6bb3790..d41a55e 100644
--- a/.taskcat.yml
+++ b/.taskcat.yml
@@ -3,36 +3,38 @@ project:
   owner: quickstart@amazon.com
   package_lambda: false
   regions:
-  - ap-northeast-1
-  - ap-northeast-2
-  - ap-south-1
-  - ap-southeast-1
-  - ap-southeast-2
-  - ca-central-1
-  - eu-central-1
-  - eu-west-1
-  - eu-west-2
-  - sa-east-1
-  - us-east-1
-  - us-east-2
-  - us-west-1
   - us-west-2
   s3_bucket: ''
 tests:
   splunk-enterprise:
     parameters:
       AvailabilityZones: $[taskcat_genaz_2]
-      HECClientLocation: 10.0.0.0/16
-      KeyName: taskcat-test
+      KeyName: [your-aws-key]
       QSS3BucketName: $[taskcat_autobucket]
+      QSS3KeyPrefix: quickstart-splunk-enterprise/
       QSS3BucketRegion: $[taskcat_current_region]
-      SSHClientLocation: 10.0.0.0/16
-      SplunkAdminPassword: $[taskcat_genpass_10]
-      SplunkClusterSecret: $[taskcat_genpass_10]
-      SplunkIndexerDiscoverySecret: $[taskcat_genpass_10]
-      WebClientLocation: 72.21.196.66/32
-    regions:
-    - us-west-1
-    - us-east-2
+      SplunkAdminPassword: $[taskcat_genpass_8S]
+      SplunkClusterSecret: $[taskcat_genpass_8S]
+      SplunkIndexerDiscoverySecret: $[taskcat_genpass_8S]
+      IndexerInstanceType: i3.4xlarge
+      SearchHeadInstanceType: c5.4xlarge
+      SplunkIndexerDiskSize: '300'
+      SplunkSearchHeadDiskSize: '300'
+      SHCEnabled: 'no'
+      SplunkIndexerCount: 4
+      SplunkReplicationFactor: 2
+      SplunkSearchFactor: 2
+      SplunkLicenseBucket: [splunk-license-bucket-name]
+      SplunkLicensePath: [splunk-license-file]
+      WebClientLocation: 1.2.3.4/32
+      HECClientLocation: 1.2.3.4/32
+      SSHClientLocation: 1.2.3.4/32
+      VPCCIDR: 10.0.0.0/16
+      PublicSubnet1CIDR: 10.0.1.0/24
+      PublicSubnet2CIDR: 10.0.2.0/24
+      PublicSubnet3CIDR: 10.0.3.0/24
+      NumberOfAZs: 2
+      SmartStoreBucketName: $[taskcat_autobucket]
+    regions: $[taskcat_current_region]
     s3_bucket: ''
-    template: templates/splunk-enterprise-master.template.yaml
+    template: templates/splunk-enterprise-main.template.yaml
diff --git a/README.md b/README.md
index 955e8f8..b8c6536 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ View the accompanying [deployment guide](https://fwd.aws/bGBmy) for everything y
 
 ### Prerequisites
 
-Before getting started with the template configuration, you will need to make your Splunk Enterprise license privately accessible for CloudFormation template deployment via S3 download.  The following steps will guide you through that process.   *(Note:  This step is not required, and you can upload your license from the Splunk web interface.  It is, however, required that you have a non-trial Splunk Enterprise license to fully utilize the deployment our template creates.  If you don't already have a Splunk Enterprise license, you can obtain one by contacting sales@splunk.com.)*
+Before getting started with the template configuration, you will need to make your Splunk Enterprise license privately accessible for CloudFormation template deployment via S3 download.  The following steps will guide you through that process.   *(Note:  This step is required.  A non-trial Splunk Enterprise license is required to allow our template to configure the Splunk deployment.  If you don't already have a Splunk Enterprise license, you can obtain one by contacting sales@splunk.com.)*
 
  1. From the AWS Console, select "S3" under the "Storage" heading, or by simply typing "S3" into the search bar.
  2. You can either select an existing private bucket to upload to, or create a new one. If you select an existing bucket, make sure its access policy does not grant public access. By default, all the S3 resources are private, so only the AWS account that created the resources can access them. For this exercise, I'm outlining how to create a new bucket.
diff --git a/scripts/user_data.sh b/scripts/user_data.sh
new file mode 100644
index 0000000..aa2b69c
--- /dev/null
+++ b/scripts/user_data.sh
@@ -0,0 +1,614 @@
+#!/bin/bash -xe
+
+#### start universal functions
+function base
+{
+
+  # variables
+  export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
+  export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
+  export SPLUNK_USER=splunk
+  export SPLUNK_BIN=/opt/splunk/bin/splunk
+  export SPLUNK_HOME=/opt/splunk
+
+  # make cloud-init output log readable by root only to protect sensitive parameter values
+  chmod 600 /var/log/cloud-init-output.log
+
+  #- Newer versions of the Splunk AMI do not come with Splunk pre-installed.  Instead Splunk 
+  #- is installed via ansible as part of cloud-init.  The following code (line 23 & 24) is 
+  #- needed to ensure the ansible code is ran prior to the remainder of this script. Without 
+  #- explicitly executing ansible first, the configuration in this user_data.sh script tries 
+  #- (and fails) to execute as there isn't a Splunk deployment to configure.
+
+  # run the ansible code 
+  (cd /opt/splunk-ansible && time sudo -u ec2-user -E -S bash -c "SPLUNK_BUILD_URL=/tmp/splunk.tgz SPLUNK_ENABLE_SERVICE=true  SPLUNK_PASSWORD=SPLUNK-$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id) ansible-playbook -i inventory/environ.py site.yml")
+
+  # setup auth with user-selected admin password
+  mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak
+  cat >> $SPLUNK_HOME/etc/system/local/user-seed.conf << end
+  [user_info]
+  USERNAME = admin
+  PASSWORD = $ADMIN_PASSWORD
+end
+
+  sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg
+  touch $SPLUNK_HOME/etc/.ui_login
+
+  # restart Splunk for admin password update
+  $SPLUNK_BIN restart
+}
+
+function restart_signal
+{
+
+  # restart splunk
+  $SPLUNK_BIN restart
+
+  # communicate back to CloudFormation the status of the instance creation
+  /opt/aws/bin/cfn-signal -e $? --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+
+  # disable splunk user login
+  usermod --expiredate 1 splunk
+}
+
+#### end universal config
+
+#####
+#### start role-specific functions
+#####
+
+###
+# setup nvme drives for i3 indexers
+function nvme_setup
+{
+  # first, determine the instance type.
+  ec2_type=$(curl -s http://169.254.169.254/latest/meta-data/instance-type)
+
+  # this script is intended to run on i3* instance types.
+  if [[ "$ec2_type" != *"i3"* ]]
+  then
+    return 0
+  fi
+
+  # find the attached nvme drives.  lsblk could work here, but utilizing the nvme-list utility due to
+  # json formatting and simpler parsing.  install the nvme-cli and jq packages to accomplish this.
+  yum -y install nvme-cli jq >/dev/null
+
+  # save the nvme drive information to a temp file for parsing
+  nvme list --output-format=json > /tmp/nvme_drive.json
+
+  # declare the nvme device array
+  declare -a nvme_devices
+  unset nvme_devices
+
+  for nvme_device in $(jq '.Devices[] | .DevicePath' /tmp/nvme_drive.json)
+  do
+    # test to ensure that the storage device is instance storage.  in testing, I have
+    # seen EBS volues show as NVME.  this logic will ensure attached EBS devices are not
+    # added to the nvme raid0
+    nvme_model_type=$(jq -r '.Devices[] | select(.DevicePath=='$nvme_device') | .ModelNumber' /tmp/nvme_drive.json)
+    if [[ $nvme_model_type = *"NVMe Instance Storage"* ]]
+    then
+      # unfortunate 'hack' here to remove the quotes from the device name.  without them, the jq lookup
+      # will fail in the previous step.  however, they need to be removed for the md raid creation later.
+      # additionally, since there needs to be a space between device names for the md create, convert
+      # quotes to spaces, and remove leading space.  this leaves "$nvme_device " (note trailing space)
+      # stored in the array.  this will allow for simply using the contents of the array as an argument for
+      # building the raid0 device
+      nvme_device=$(echo $nvme_device|sed 's/"/ /g'| sed 's/^ //g')
+
+      # save device list in nvme_devices array
+      nvme_devices+=("$nvme_device")
+    else
+      # if the nvme model type is not instance storage, continue to the next iteration of the loop
+      continue
+    fi
+  done
+
+  # name of the raid device to create
+  raid_device="/dev/md0"
+
+  # mount point of the raid device
+  raid_mount="/opt/splunk"
+
+  # make directory for mount point
+  mkdir -p $raid_mount
+
+  # create the raid device
+  mdadm --create $raid_device --level=raid0 --raid-devices=${#nvme_devices[@]} ${nvme_devices[@]}
+
+  # create filesystem on raid device
+  if [ ${#nvme_devices[@]} -eq 1 ]
+   then
+      discardOption=""
+    else
+      discardOption="-E nodiscard"
+  fi
+
+  mkfs.ext4 -m 2 -F -F ${discardOption} $raid_device
+
+  # add entry to fstab for mounting on reboot
+  echo "$raid_device $raid_mount auto defaults,nofail,noatime 0 2" >>/etc/fstab
+
+  # mount device
+  mount $raid_device
+
+}
+
+###
+# Splunk Cluster Manager / License Manager
+###
+function splunk_cm
+{
+  # execute base install and configuration
+  base
+
+  #export RESOURCE="SplunkCM"
+  printf '%s\t%s\n' "$LOCALIP" 'splunklicense' >> /etc/hosts
+  hostname splunklicense
+
+  #- for the CM, we can't reference CM_PRIVATEIP in the CloudFormation UserData like
+  #- we do in the other resources because the CM hasn't been created yet.  To keep the
+  #- syntax consistent across each resource in user_data.sh, export $CM_PRIVATEIP to
+  #- the CM's local ip address
+  export CM_PRIVATEIP=$LOCALIP
+
+  # Install license from metadata.
+  if [ $INSTALL_LICENSE = 1 ]; then
+    mkdir -p $SPLUNK_HOME/etc/licenses/enterprise/
+    mv /tmp/splunk.license $SPLUNK_HOME/etc/licenses/enterprise/splunk.license
+    chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/licenses/enterprise
+    #/opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+  fi
+
+  # Increase splunkweb connection timeout with splunkd
+  mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end
+  [settings]
+  splunkdConnectionTimeout = 300
+end
+
+ # Forward to indexer cluster using indexer discovery\n",
+ cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end
+  # Turn off indexing
+  [indexAndForward]
+  index = false
+
+  [tcpout]
+  defaultGroup = indexer_cluster_peers
+  forwardedindex.filter.disable = true
+  indexAndForward = false
+
+  [tcpout:indexer_cluster_peers]
+  indexerDiscovery = cluster_master
+
+  [indexer_discovery:cluster_master]
+  pass4SymmKey = $SYMMKEY
+  master_uri = https://127.0.0.1:8089
+end
+
+  chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated
+  $SPLUNK_BIN restart
+  # sleep 20 seconds to make sure Splunk has restarted before applying the configuration
+  sleep 20
+
+  # log in to splunk to execute several commands without requiring -auth
+  sudo -u $SPLUNK_USER $SPLUNK_BIN login -auth admin:$ADMIN_PASSWORD
+
+  # create the indexer cluster
+  sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode master -multisite true \
+  -replication_factor $REPFACTOR -available_sites $SITELIST -site site1 \
+  -site_replication_factor origin:1,total:$REPFACTOR -site_search_factor \
+  origin:1,total:$SEARCHFACTOR -secret $SPLUNK_CLUSTER_SECRET -cluster_label SplunkIndexersASG
+
+
+  # Configure indexer discovery
+  cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end
+
+  [indexer_discovery]
+  pass4SymmKey = $SYMMKEY
+  indexerWeightByDiskCapacity = true
+end
+  chown $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local/server.conf
+
+  # generate the config file and HEC token
+  sudo -u $SPLUNK_USER $SPLUNK_BIN http-event-collector enable \
+  -uri https://localhost:8089
+
+  sudo -u $SPLUNK_USER $SPLUNK_BIN http-event-collector create default-token \
+  -uri https://localhost:8089 > /tmp/token
+  TOKEN=`sed -n 's/\\ttoken=//p' /tmp/token` && rm /tmp/token
+
+  # place generated config into master-apps
+  mkdir -p $SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local
+  mv $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf $SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local
+
+  # peer config 2: enable splunk tcp input
+  cat >>$SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local/inputs.conf <<end
+  [splunktcp://9997]
+  disabled=0
+end
+
+  # Configure smartstore as a configuration in a bundle.
+
+  mkdir -p $SPLUNK_HOME/etc/master-apps/_cluster/local/
+  touch $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
+
+  cat >>$SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf <<end
+  [default]
+  repFactor = auto
+  remotePath = volume:remote_store/splunk_db/$_index_name
+  coldPath=$SPLUNK_DB/$_index_name/colddb
+  thawedPath=$SPLUNK_DB/$_index_name/thaweddb
+
+  [volume:remote_store]
+  storageType = remote
+
+  path = s3://$SMARTSTORE_BUCKET
+  remote.s3.encryption = sse-s3
+end
+
+  chown $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
+  restart_signal
+
+  # signal with the generated HEC to show on cloudformation outputs section
+  /opt/aws/bin/cfn-signal -e 0 -i token -d $TOKEN $SplunkCMWaitHandle
+
+}
+
+function splunk_indexer
+{
+  #- run through setting up nvme raid device.
+  #- if the indexer is not an i3, the function immediately exits and continues to base config as normal
+  nvme_setup
+
+  #- execute base install and configuration
+  base
+
+  export INSTANCE_MAC_ADDR=$(curl -s http://169.254.169.254/latest/meta-data/mac)
+  export INSTANCE_SUBNET_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/$INSTANCE_MAC_ADDR/subnet-id)
+  export RESOURCE="SplunkIndexerNodesASG"
+
+  #- configure smartstore as if it were a bundle already pushed by the CM.
+
+  mkdir -p $SPLUNK_HOME/etc/slave-apps/_cluster/local
+  touch $SPLUNK_HOME/etc/slave-apps/_cluster/local/indexes.conf
+
+  cat >> $SPLUNK_HOME/etc/slave-apps/_cluster/local/indexes.conf << end
+  [default]
+  repFactor = auto
+  remotePath = volume:remote_store/splunk_db/$_index_name
+  coldPath=$SPLUNK_DB/$_index_name/colddb
+  thawedPath=$SPLUNK_DB/$_index_name/thaweddb
+end
+
+  cat >>$SPLUNK_HOME/etc/slave-apps/_cluster/local/indexes.conf <<end
+
+  [volume:remote_store]
+  storageType = remote
+  path = s3://$SMARTSTORE_BUCKET
+  remote.s3.encryption = sse-s3
+end
+
+  chown -R splunk:splunk $SPLUNK_HOME/etc/slave-apps/_cluster/
+  $SPLUNK_BIN restart
+
+
+  # set splunk server name to local hostname.
+  sudo -u $SPLUNK_USER $SPLUNK_BIN set servername $HOSTNAME -auth admin:$ADMIN_PASSWORD
+
+  # Increase splunkweb connection timeout with splunkd"
+  mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local
+
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end
+  [settings]
+  splunkdConnectionTimeout = 300
+end
+  # Configure some SHC parameters
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/server.conf <<end
+  [shclustering]
+  register_replication_address = $LOCALIP
+end
+
+  # Configure instance as license slave
+  cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end
+  [license]
+  master_uri = https://$CM_PRIVATEIP:8089
+end
+
+  chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated
+
+  case $INSTANCE_SUBNET_ID in
+    "$SUBNET1_ID")
+      site=site1
+    ;;
+    "$SUBNET2_ID")
+      site=site2
+    ;;
+    "$SUBNET3_ID")
+      site=site3
+    ;;
+    *)
+      echo "Unexpected subnet id"
+      exit 1
+  esac
+
+
+  # sleep to ensure splunkd is up before modifying cluster config
+  sleep 10
+
+  sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode slave \
+    -site $site \
+    -manager_uri https://$CM_PRIVATEIP:8089 \
+    -auth admin:$ADMIN_PASSWORD \
+    -replication_port 9887 \
+    -secret $SPLUNK_CLUSTER_SECRET
+
+  restart_signal
+}
+
+function splunk_cluster_sh
+{
+
+  # the splunk search head cluster in quickstart is pre-defined with 3 nodes.
+  # verify that the argument passed is 1, 2, or 3
+
+  if [[ "$1" =~ ^[1-3]$ ]]
+  then
+      # execute base install and configuration
+      base
+
+      # search head number is the argument passed.  1 = SH1, 2 = SH2, etc.
+      num=$1
+
+      # if this is a 3AZ deployment, place the third search head in site3.
+      # if not, place the third search head in site1.
+      # in all cases searchhead1 is site1, and searchhead2 is site2
+
+      if [ $THREEAZ -eq 0 ] && [ $num -eq 3 ]
+      then
+        sitenum="site1"
+      else
+        sitenum="site$num"
+      fi
+
+      #export RESOURCE="SplunkSHCMember$num"
+
+      printf '%s\t%s\n' \"$LOCALIP\" \"splunksearch-$num\" >> /etc/hosts
+      hostname "splunksearch-$num"
+
+      # set splunk servername
+      sudo -u $SPLUNK_USER $SPLUNK_BIN set servername SHC$num
+
+      # Increase splunkweb connection timeout with splunkd
+      cat >$SPLUNK_HOME/etc/system/local/web.conf <<end
+      [settings]
+      splunkdConnectionTimeout = 300
+end
+      # Configure some SHC parameters
+      cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end
+    [shclustering]
+    register_replication_address = $LOCALIP
+end
+      chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local
+      $SPLUNK_BIN restart
+
+      #- sleep 20 seconds to make sure Splunk has restarted before applying the configuration
+      sleep 20
+
+      #- log in to splunk to execute several commands without requiring -auth
+      sudo -u $SPLUNK_USER $SPLUNK_BIN login -auth admin:$ADMIN_PASSWORD
+
+      sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave \
+      -master_uri https://$CM_PRIVATEIP:8089
+
+      #- configure searchhead cluster
+      #echo "### setup splunk search head cluster"
+      #echo "### sudo -u $SPLUNK_USER $SPLUNK_BIN init shcluster-config -mgmt_uri https://$LOCALIP:8089 -replication_port 8090 -replication_factor $SH_REPLICATION_FACTOR -conf_deploy_fetch_url https://$SH_DEPLOYER_IP:8089 \ -shcluster_label SplunkSHC -secret $SPLUNK_CLUSTER_SECRET"
+
+      sudo -u $SPLUNK_USER $SPLUNK_BIN init shcluster-config \
+      -auth admin:$ADMIN_PASSWORD \
+      -mgmt_uri https://$LOCALIP:8089 \
+      -replication_port 8090 \
+      -replication_factor $SH_REPLICATION_FACTOR \
+      -conf_deploy_fetch_url https://$SH_DEPLOYER_IP:8089 \
+      -shcluster_label SplunkSHC\
+      -secret $SPLUNK_CLUSTER_SECRET
+
+      $SPLUNK_BIN restart
+      sleep 20
+
+      #echo "### sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode searchhead -site $sitenum -manager_uri https://$CM_PRIVATEIP:8089 -secret $SPLUNK_CLUSTER_SECRET"
+
+      sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config \
+      -mode searchhead \
+      -site $sitenum \
+      -manager_uri https://$CM_PRIVATEIP:8089 \
+      -secret $SPLUNK_CLUSTER_SECRET \
+      -auth admin:$ADMIN_PASSWORD 
+
+      # Bootstrap SHC captain
+
+      # Since we need all three searchhead ip addresses in order to make a captain,
+      # and searchhead3 is the last to be created, it will be bootstrapped as the
+      # first searchhead cluster captain.
+      if [ $num -eq 3 ]
+      then
+        export SH3_IP=$LOCALIP
+
+        #echo "### sudo -u $SPLUNK_USER $SPLUNK_BIN bootstrap shcluster-captain -servers_list https://$SH1_IP:8089,https://$SH2_IP:8089,https://$SH3_IP:8089"
+
+        sudo -u $SPLUNK_USER $SPLUNK_BIN bootstrap shcluster-captain \
+        -servers_list https://$SH1_IP:8089,https://$SH2_IP:8089,https://$SH3_IP:8089 \
+        -auth admin:$ADMIN_PASSWORD
+      fi
+      restart_signal
+  else
+    echo "Incorrect value passed.  \"$1\" is not 1, 2, or 3."
+    # communicate back to CloudFormation the status of the instance creation
+    /opt/aws/bin/cfn-signal -e 1 --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+    exit 1
+  fi
+}
+
+###
+# Splunk Deployer
+###
+function splunk_deployer
+{
+  # execute base install and configuration
+  base
+
+  #export RESOURCE="SplunkSHCDeployer"
+  printf "$LOCALIP \t splunk-shc-deployer\n" >> /etc/hosts
+  hostname splunk-shc-deployer
+
+  # Increase splunkweb connection timeout with splunkd
+  mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end
+[settings]
+splunkdConnectionTimeout = 300
+end
+
+  # Configure some SHC parameters
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/server.conf <<end
+[shclustering]
+pass4SymmKey = $SYMMKEY
+shcluster_label = SplunkSHC
+end
+
+  # Forward to indexer cluster using indexer discovery
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end
+# Turn off indexing on the search head
+[indexAndForward]
+index = false
+
+[tcpout]
+defaultGroup = indexer_cluster_peers
+forwardedindex.filter.disable = true
+indexAndForward = false
+
+[tcpout:indexer_cluster_peers]
+indexerDiscovery = cluster_master
+
+[indexer_discovery:cluster_master]
+pass4SymmKey = $SYMMKEY
+master_uri = https://$CM_PRIVATEIP:8089
+end
+
+  # update permissions
+  chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated
+
+  # Add base config for search head cluster members
+  mkdir -p $SPLUNK_HOME/etc/shcluster/apps/member-base-autogenerated/local
+  cat >>$SPLUNK_HOME/etc/shcluster/apps/member-base-autogenerated/local/outputs.conf <<end
+# Turn off indexing on the search head
+[indexAndForward]
+index = false
+
+[tcpout]
+defaultGroup = indexer_cluster_peers
+forwardedindex.filter.disable = true
+indexAndForward = false
+
+[tcpout:indexer_cluster_peers]
+indexerDiscovery = cluster_master
+
+[indexer_discovery:cluster_master]
+pass4SymmKey = $SYMMKEY
+master_uri = https://$CM_PRIVATEIP:8089
+end
+
+  #- set ownership
+  chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps
+
+  $SPLUNK_BIN restart
+  sleep 10
+
+  sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave \
+  -master_uri https://$CM_PRIVATEIP:8089 \
+  -auth admin:$ADMIN_PASSWORD
+
+  sudo -u $SPLUNK_USER $SPLUNK_BIN apply shcluster-bundle -action stage --answer-yes
+
+  restart_signal
+}
+
+## splunk single search head
+function splunk_single_sh
+{
+  # execute base install and configuration
+  base
+
+  #export RESOURCE="SplunkSearchHeadInstance"
+
+  # sleep 20 seconds to make sure Splunk has restarted before applying the configuration
+  sleep 20
+
+  # add hostname to /etc/hosts and set hostname
+  printf "$LOCALIP \t splunksearch\n" >> /etc/hosts
+  hostname splunksearch
+
+  # Increase splunkweb connection timeout with splunkd
+  mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end
+  [settings]
+  splunkdConnectionTimeout = 300
+end
+
+  # Forward to indexer cluster using indexer discovery
+  cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end
+  # Turn off indexing on the search head
+  [indexAndForward]
+  index = false
+
+  [tcpout]
+  defaultGroup = indexer_cluster_peers
+  forwardedindex.filter.disable = true
+  indexAndForward = false
+  [tcpout:indexer_cluster_peers]
+  indexerDiscovery = cluster_master
+  [indexer_discovery:cluster_master]
+  pass4SymmKey = $SYMMKEY
+  master_uri = https://$CM_PRIVATEIP:8089
+end
+
+  # update permissions
+  chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated
+
+  # setup license server communication
+  sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave -master_uri https://$CM_PRIVATEIP:8089 -auth admin:$ADMIN_PASSWORD
+
+  # configure communication to the splunk indexer cluster
+  sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config \
+  -secret $SPLUNK_CLUSTER_SECRET \
+  -mode searchhead \
+  -site site1 \
+  -master_uri https://$CM_PRIVATEIP:8089 \
+  -auth admin:$ADMIN_PASSWORD
+
+  # final restart and cfn signal
+  restart_signal
+}
+
+case "$1" in
+  "single_sh")
+  splunk_single_sh
+  ;;
+  "cluster_sh")
+  splunk_cluster_sh $2
+  ;;
+  "indexer")
+  splunk_indexer
+  ;;
+  "cm")
+  splunk_cm
+  ;;
+  "deployer")
+  splunk_deployer
+  ;;
+  *)
+  echo "Usage:  $(basename -- "$0") [single_sh|cluster_sh|indexer|cm|deployer]";
+  echo "        Note: a single argument of integers 1,2, or 3 must be passed to cluster_sh to specify the specific search head cluster node."
+  exit 0
+esac
diff --git a/templates/splunk-enterprise-master.template.yaml b/templates/splunk-enterprise-main.template.yaml
similarity index 59%
rename from templates/splunk-enterprise-master.template.yaml
rename to templates/splunk-enterprise-main.template.yaml
index 47a0604..8f1dd04 100644
--- a/templates/splunk-enterprise-master.template.yaml
+++ b/templates/splunk-enterprise-main.template.yaml
@@ -1,8 +1,8 @@
 AWSTemplateFormatVersion: '2010-09-09'
-Description: Splunk deployment with indexer, search head clustering and cluster master. (qs-1qup6ramh)
+Description: Splunk deployment with indexer clustering, search head with optional search head clustering, and cluster manager/license server. (qs-1qup6ramp)
 Metadata:
   QuickStartDocumentation:
-    EntrypointName: "Parameters for a new VPC"
+    EntrypointName: "Splunk QuickStart (New VPC)"
   AWS::CloudFormation::Interface:
     ParameterGroups:
       - Label:
@@ -33,18 +33,18 @@ Metadata:
           - SplunkSearchHeadDiskSize
           - SplunkReplicationFactor
           - SplunkSearchFactor
+          - SmartStoreBucketName
           - SHCEnabled
-          - IndexerApps
-          - SearchHeadApps
       - Label:
           default: AWS Quick Start Configuration
         Parameters:
           - QSS3BucketName
-          - QSS3BucketRegion
           - QSS3KeyPrefix
     ParameterLabels:
       AvailabilityZones:
         default: Availability Zones
+      SplunkSearchHeadDiskSize:
+        default: Size (in GB) of Splunk search head disk
       NumberOfAZs:
         default: Number of Availability Zones
       WebClientLocation:
@@ -65,8 +65,6 @@ Metadata:
         default: Public Subnet 3 CIDR
       QSS3BucketName:
         default: QuickStart S3 Bucket Name
-      QSS3BucketRegion:
-        default: Quick Start S3 bucket region
       QSS3KeyPrefix:
         default: QuickStart S3 Key Prefix
       SHCEnabled:
@@ -79,8 +77,6 @@ Metadata:
         default: No. of Splunk Indexers
       SplunkIndexerDiskSize:
         default: Indexer Disk Size
-      SplunkSearchHeadDiskSize:
-        default: Search Head(s) Disk Size
       SplunkLicenseBucket:
         default: Splunk License Bucket
       SplunkLicensePath:
@@ -89,95 +85,75 @@ Metadata:
         default: Index Cluster Replication Factor
       SplunkSearchFactor:
         default: Index Cluster Search Factor
+      SmartStoreBucketName:
+        default: Name of bucket that will be created for SmartStore storage
       SplunkClusterSecret:
         default: Shared Security Key for Cluster Nodes
       SplunkIndexerDiscoverySecret:
         default: Shared Security Key for Forwarders using Indexer Discovery
-      IndexerApps:
-        default: Apps/Add-ons to pre-Install on Splunk Indexers
-      SearchHeadApps:
-        default: Apps/Add-ons to pre-Install on Splunk Search Heads
       VPCCIDR:
         default: VPC CIDR
 Parameters:
   AvailabilityZones:
-    Description: List of Availability Zones to use for the subnets in the VPC (logical
-      order preserved). This must match the Number of Availability Zones parameter
-      value.
+    Description: List of Availability Zones to use for the subnets in the VPC (logical order preserved). This must match the Number of Availability Zones parameter value.
     Type: List<AWS::EC2::AvailabilityZone::Name>
   NumberOfAZs:
     AllowedValues:
       - '2'
       - '3'
     Default: '2'
-    Description: Number of Availability Zones to use in the VPC. This must match your
-      selections in the list of Availability Zones parameter.
+    Description: Number of Availability Zones to use in the VPC. This must match your selections in the list of Availability Zones parameter.
     Type: String
   WebClientLocation:
+    Default: '0.0.0.0/0'
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to connect to the Splunk web
-      interface. Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: The IP address range that is allowed to connect to the Splunk web interface. Note that a value of 0.0.0.0/0 will allow access from ANY ip address.
     MaxLength: '19'
     MinLength: '9'
     Type: String
   HECClientLocation:
+    Default: '0.0.0.0/0'
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to send data to Splunk HTTP
-      Event Collector. Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: 'The IP address range that is allowed to send data to Splunk HTTP Event Collector. Note that a value of 0.0.0.0/0 will allow access from ANY ip address.'
     MaxLength: '19'
     MinLength: '9'
     Type: String
   IndexerInstanceType:
     AllowedValues:
-      - c4.2xlarge
-      - c4.4xlarge
-      - c4.8xlarge
-      - m4.2xlarge
-      - m4.4xlarge
-      - m4.10xlarge
-      - c5.2xlarge
+      - m5.4xlarge
+      - m5.8xlarge
       - c5.4xlarge
       - c5.9xlarge
       - c5.18xlarge
-      - i3.2xlarge
       - i3.4xlarge
       - i3.8xlarge
+      - i3.16xlarge
+      - i3en.3xlarge
+      - i3en.6xlarge
+      - i3en.12xlarge
+      - i3en.24xlarge
     Description: EC2 instance type for Splunk Indexers
     ConstraintDescription: must be a valid EC2 instance type.
-    Default: c5.4xlarge
+    Default: i3.4xlarge
     Type: String
   SearchHeadInstanceType:
     AllowedValues:
-      - c4.2xlarge
-      - c4.4xlarge
-      - c4.8xlarge
-      - r4.4xlarge
-      - r4.8xlarge
-      - r4.16xlarge
-      - c5.2xlarge
+      - r5.4xlarge
+      - r5.8xlarge
+      - r5.16xlarge
       - c5.4xlarge
       - c5.9xlarge
+      - c5.18xlarge
       - m5.2xlarge
       - m5.4xlarge
+      - m5.8xlarge
       - m5.12xlarge
     Description: EC2 instance type for Splunk Search Heads
     ConstraintDescription: must be a valid EC2 instance type.
     Default: c5.4xlarge
     Type: String
-  IndexerApps:
-    Description: Comma separated list of URLs of Splunk App (or Add-on) tarballs (.spl)
-      to pre-install on indexer(s)
-    Default: ''
-    Type: CommaDelimitedList
-  SearchHeadApps:
-    Description: Comma separated list of URLs of Splunk App (or Add-on) tarballs (.spl)
-      to pre-install on search head(s)
-    Default: ''
-    Type: CommaDelimitedList
   KeyName:
     ConstraintDescription: Must be the name of an existing EC2 KeyPair.
     Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
@@ -186,27 +162,24 @@ Parameters:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
     ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
     Default: 10.0.1.0/24
-    Description: The address space that will be assigned to the first Splunk server
-      subnet. (x.x.x.x/x notation)
+    Description: The address space that will be assigned to the first Splunk server subnet. (x.x.x.x/x notation)
     Type: String
   PublicSubnet2CIDR:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
+    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x
     Default: 10.0.2.0/24
-    Description: The address space that will be assigned to the second Splunk server
-      subnet. (x.x.x.x/x notation)
+    Description: The address space that will be assigned to the second Splunk server subnet. (x.x.x.x/x notation)
     Type: String
   PublicSubnet3CIDR:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
     ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
     Default: 10.0.3.0/24
-    Description: The address space that will be assigned to the second Splunk server
-      subnet. (x.x.x.x/x notation)
+    Description: The address space that will be assigned to the second Splunk server subnet. (x.x.x.x/x notation)
     Type: String
   QSS3BucketName:
-    Default: aws-quickstart
     Description: S3 bucket name for the Quick Start assets.
     Type: String
+    Default: aws-quickstart
   QSS3BucketRegion:
     Default: 'us-west-2'
     Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
@@ -220,58 +193,58 @@ Parameters:
       - 'yes'
       - 'no'
     Default: 'no'
-    Description: Do you want to build a Splunk search head cluster?
+    Description: Do you want to build a Splunk search head cluster? 
     Type: String
   SSHClientLocation:
+    Default: '0.0.0.0/0'
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to SSH to the EC2 instances.
-      Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: The IP address range that is allowed to SSH to the EC2 instances. Note that a value of 0.0.0.0/0 will allow access from ANY ip address
     MaxLength: '19'
     MinLength: '9'
     Type: String
   SplunkAdminPassword:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: Admin password for Splunk. Must be at least 6 characters containing
-      letters, numbers and symbols
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters and numbers.
+    Description: Admin password for Splunk. Must be at least 8 characters containing letters and numbers.
     MaxLength: '32'
     MinLength: '6'
     NoEcho: 'true'
     Type: String
   SplunkIndexerCount:
-    ConstraintDescription: must be a valid number, 3-10
-    Default: '3'
-    Description: How many Splunk indexers to launch.  [3-10]
+    ConstraintDescription: must be a valid number, 4-10
+    Default: '4'
+    Description: How many Splunk indexers to launch.  [4-10]
     MaxValue: '10'
-    MinValue: '3'
+    MinValue: '4'
     Type: Number
   SplunkIndexerDiskSize:
-    ConstraintDescription: must be a valid number, 320-16000
-    Default: '320'
-    Description: The size of the attached EBS volume to the Splunk indexers.  (in
-      GB)
+    ConstraintDescription: must be a valid number, 100-16000
+    Default: '334'
+    Description: The size of the attached EBS volume to the Splunk indexers.  (in GB)
     MaxValue: '16000'
-    MinValue: '320'
+    MinValue: '100'
     Type: Number
   SplunkSearchHeadDiskSize:
-    ConstraintDescription: must be a valid number, 320-16000
-    Default: '320'
-    Description: The size of the attached EBS volume to the Splunk search head(s).  (in
-      GB)
+    ConstraintDescription: must be a valid number, 100-16000
+    Default: '334'
+    Description: The size of the attached EBS volume to the Splunk search head(s).  (in GB)
     MaxValue: '16000'
-    MinValue: '320'
+    MinValue: '100'
     Type: Number
   SplunkLicenseBucket:
-    Default: ''
-    Description: Name of private S3 bucket with licenses to be accessed via authenticated
-      requests
+    AllowedPattern: (?=^.{3,63}$)(?!xn--)([a-z0-9](?:[a-z0-9-]*)[a-z0-9])$
+    ConstraintDescription: Required for QuickStart to function and must be a valid s3 bucket
+    Description: Name of private S3 bucket with licenses to be accessed via authenticated requests
+    MinLength: '3'
+    MaxLength: '63'
     Type: String
   SplunkLicensePath:
-    Default: ''
-    Description: Path to license file in S3 Bucket (without leading '/')
+    ConstraintDescription: Required for QuickStart to function and must point to a valid Splunk license
+    AllowedPattern: ([0-9]|[A-Z]|[a-z]|[\/\._-])+
+    Description: Path to license file in S3 Bucket, without leading /. (for example license/splunk.license)
+    MinLength: '2'
+    MaxLength: '128'
     Type: String
   SplunkReplicationFactor:
     ConstraintDescription: must be a valid number, 2-4
@@ -283,30 +256,22 @@ Parameters:
   SplunkSearchFactor:
     ConstraintDescription: must be a valid number, 2-4
     Default: '2'
-    Description: How many copies of data should be searchable in the Splunk indexer
-      clusters
+    Description: How many copies of data should be searchable in the Splunk indexer clusters
     MaxValue: '4'
     MinValue: '2'
     Type: Number
   SplunkClusterSecret:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: Shared cluster secret for Search Head and Indexer clusters. Must
-      be at least 8 characters containing letters, numbers and symbols.
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters and numbers.
+    Description: Shared cluster secret for Search Head and Indexer clusters. Must be at least 8 characters containing letters and numbers.
     MaxLength: '32'
     MinLength: '6'
     NoEcho: 'true'
     Type: String
   SplunkIndexerDiscoverySecret:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: >-
-      Security key used for communication between your forwarders and the cluster
-      master. This value should also be used by forwarders in order to retrieve list
-      of available peer nodes from cluster master. Must be at least 8 characters containing
-      letters, numbers and symbols.
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters and numbers.
+    Description: Security key used for communication between your forwarders and the cluster manager. This value should also be used by forwarders in order to retrieve list of available peer nodes from cluster manager. Must be at least 8 characters containing letters and numbers.
     MaxLength: '32'
     MinLength: '8'
     NoEcho: 'true'
@@ -315,11 +280,13 @@ Parameters:
     AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
     ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
     Default: 10.0.0.0/16
-    Description: The address space that will be assigned to the entire VPC where Splunk
-      will reside. (Recommend at least a /16)
+    Description: The address space that will be assigned to the entire VPC where Splunk will reside. (Recommend at least a /16)
     MaxLength: '19'
     MinLength: '9'
     Type: String
+  SmartStoreBucketName:
+    Description: Name of bucket that will be created for SmartStore storage
+    Type: String
 Conditions:
   Create3AZ: !Equals
     - !Ref 'NumberOfAZs'
@@ -330,16 +297,16 @@ Resources:
     Type: AWS::CloudFormation::Stack
     Properties:
       TemplateURL:
-        !Sub
-          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template'
+        !Sub 
+          - https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml
           - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
             S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
       Parameters:
         AvailabilityZones: !Join
           - ','
           - !Ref 'AvailabilityZones'
+        CreateNATGateways: 'false'
         CreatePrivateSubnets: 'false'
-        KeyPairName: !Ref 'KeyName'
         NumberOfAZs: !Ref 'NumberOfAZs'
         PublicSubnet1CIDR: !Ref 'PublicSubnet1CIDR'
         PublicSubnet2CIDR: !Ref 'PublicSubnet2CIDR'
@@ -347,59 +314,54 @@ Resources:
         VPCCIDR: !Ref 'VPCCIDR'
       TimeoutInMinutes: 15
   SplunkStack:
-    Type: AWS::CloudFormation::Stack
-    Properties:
-      TemplateURL:
-        !Sub
-          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/splunk-enterprise.template.yaml'
-          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
-            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
-      Parameters:
-        VPCID: !GetAtt 'VPCStack.Outputs.VPCID'
-        VPCCIDR: !GetAtt 'VPCStack.Outputs.VPCCIDR'
-        PublicSubnet1ID: !GetAtt 'VPCStack.Outputs.PublicSubnet1ID'
-        PublicSubnet2ID: !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
-        PublicSubnet3ID: !If
-          - Create3AZ
-          - !GetAtt 'VPCStack.Outputs.PublicSubnet3ID'
-          - !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
-        NumberOfAZs: !Ref 'NumberOfAZs'
-        IndexerInstanceType: !Ref 'IndexerInstanceType'
-        SearchHeadInstanceType: !Ref 'SearchHeadInstanceType'
-        SplunkAdminPassword: !Ref 'SplunkAdminPassword'
-        SplunkClusterSecret: !Ref 'SplunkClusterSecret'
-        SplunkIndexerDiscoverySecret: !Ref 'SplunkIndexerDiscoverySecret'
-        SplunkLicenseBucket: !Ref 'SplunkLicenseBucket'
-        SplunkLicensePath: !Ref 'SplunkLicensePath'
-        KeyName: !Ref 'KeyName'
-        SSHClientLocation: !Ref 'SSHClientLocation'
-        HECClientLocation: !Ref 'HECClientLocation'
-        WebClientLocation: !Ref 'WebClientLocation'
-        SplunkIndexerCount: !Ref 'SplunkIndexerCount'
-        SHCEnabled: !Ref 'SHCEnabled'
-        SplunkIndexerDiskSize: !Ref 'SplunkIndexerDiskSize'
-        SplunkReplicationFactor: !Ref 'SplunkReplicationFactor'
-        QSS3BucketName: !Ref QSS3BucketName
-        QSS3BucketRegion: !Ref QSS3BucketRegion
-        QSS3KeyPrefix: !Ref QSS3KeyPrefix
-        IndexerApps: !Join
-          - ','
-          - !Ref 'IndexerApps'
-        SearchHeadApps: !Join
-          - ','
-          - !Ref 'SearchHeadApps'
-      TimeoutInMinutes: 60
+      Type: AWS::CloudFormation::Stack
+      Properties:
+        TemplateURL:
+          !Sub
+            - https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/splunk-enterprise.template.yaml
+            - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
+              S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
+        Parameters:
+          VPCID: !GetAtt 'VPCStack.Outputs.VPCID'
+          VPCCIDR: !GetAtt 'VPCStack.Outputs.VPCCIDR'
+          PublicSubnet1ID: !GetAtt 'VPCStack.Outputs.PublicSubnet1ID'
+          PublicSubnet2ID: !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
+          PublicSubnet3ID: !If
+            - Create3AZ
+            - !GetAtt 'VPCStack.Outputs.PublicSubnet3ID'
+            - !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
+          NumberOfAZs: !Ref 'NumberOfAZs'
+          IndexerInstanceType: !Ref 'IndexerInstanceType'
+          SearchHeadInstanceType: !Ref 'SearchHeadInstanceType'
+          SplunkAdminPassword: !Ref 'SplunkAdminPassword'
+          SplunkClusterSecret: !Ref 'SplunkClusterSecret'
+          SplunkIndexerDiscoverySecret: !Ref 'SplunkIndexerDiscoverySecret'
+          SplunkLicenseBucket: !Ref 'SplunkLicenseBucket'
+          SplunkLicensePath: !Ref 'SplunkLicensePath'
+          KeyName: !Ref 'KeyName'
+          SSHClientLocation: !Ref 'SSHClientLocation'
+          HECClientLocation: !Ref 'HECClientLocation'
+          WebClientLocation: !Ref 'WebClientLocation'
+          SplunkIndexerCount: !Ref 'SplunkIndexerCount'
+          SHCEnabled: !Ref 'SHCEnabled'
+          SplunkIndexerDiskSize: !Ref 'SplunkIndexerDiskSize'
+          SplunkSearchHeadDiskSize: !Ref 'SplunkSearchHeadDiskSize'
+          SmartStoreBucketName: !Ref 'SmartStoreBucketName'
+          SplunkReplicationFactor: !Ref 'SplunkReplicationFactor'
+          SplunkSearchFactor: !Ref 'SplunkSearchFactor'
+          QSS3KeyPrefix: !Ref 'QSS3KeyPrefix' 
+          QSS3BucketName: !Ref 'QSS3BucketName' 
+        TimeoutInMinutes: 45
 Outputs:
   SearchHeadURL:
     Description: Splunk Enterprise - Search Head URL
     Value: !GetAtt 'SplunkStack.Outputs.SearchHeadURL'
-  ClusterMasterURL:
-    Description: Splunk Enterprise - Cluster Master URL
-    Value: !GetAtt 'SplunkStack.Outputs.ClusterMasterURL'
-  ClusterMasterManagementURL:
-    Description: Splunk Enterprise - Cluster Master Management URL (required for Indexer
-      Discovery)
-    Value: !GetAtt 'SplunkStack.Outputs.ClusterMasterManagementURL'
+  ClusterManagerURL:
+    Description: Splunk Enterprise - Cluster Manager URL
+    Value: !GetAtt 'SplunkStack.Outputs.ClusterManagerURL'
+  ClusterManagerManagementURL:
+    Description: Splunk Enterprise - Cluster Manager Management URL (required for Indexer Discovery)
+    Value: !GetAtt 'SplunkStack.Outputs.ClusterManagerManagementURL'
   DeployerURL:
     Description: Splunk Enterprise - Search Head Cluster Deployer URL
     Value: !GetAtt 'SplunkStack.Outputs.DeployerURL'
diff --git a/templates/splunk-enterprise.template.yaml b/templates/splunk-enterprise.template.yaml
index 1a1c5de..ffcc196 100644
--- a/templates/splunk-enterprise.template.yaml
+++ b/templates/splunk-enterprise.template.yaml
@@ -1,182 +1,61 @@
 AWSTemplateFormatVersion: '2010-09-09'
-Description: Splunk deployment with indexer, search head clustering and cluster master.
-  (qs-1qup6ramp)
-Metadata:
-  QuickStartDocumentation:
-    EntrypointName: "Parameters for an existing VPC"
-  AWSAMIRegionMap:
-    Filters:
-      SPLUNKENTHVM:
-        name: splunk_marketplace_AMI_*
-        owner-alias: aws-marketplace
-        product-code.type: marketplace
-  AWS::CloudFormation::Interface:
-    ParameterGroups:
-      - Label:
-          default: AWS Instance and Network Settings
-        Parameters:
-          - IndexerInstanceType
-          - SearchHeadInstanceType
-          - KeyName
-          - WebClientLocation
-          - HECClientLocation
-          - SSHClientLocation
-          - VPCID
-          - VPCCIDR
-          - PublicSubnet1ID
-          - PublicSubnet2ID
-          - PublicSubnet3ID
-          - NumberOfAZs
-      - Label:
-          default: Splunk Settings
-        Parameters:
-          - SplunkAdminPassword
-          - SplunkClusterSecret
-          - SplunkIndexerDiscoverySecret
-          - SplunkLicenseBucket
-          - SplunkLicensePath
-          - SplunkIndexerCount
-          - SplunkIndexerDiskSize
-          - SplunkSearchHeadDiskSize
-          - SplunkReplicationFactor
-          - SplunkSearchFactor
-          - SHCEnabled
-          - IndexerApps
-          - SearchHeadApps
-    ParameterLabels:
-      QSS3BucketName:
-        default: QuickStart S3 Bucket Name
-      QSS3BucketRegion:
-        default: Quick Start S3 bucket region
-      QSS3KeyPrefix:
-        default: QuickStart S3 Key Prefix
-      WebClientLocation:
-        default: Permitted CIDR for Splunk web interface
-      HECClientLocation:
-        default: Permitted CIDR for Splunk HTTP event collector input
-      IndexerInstanceType:
-        default: EC2 instance type for Splunk indexer
-      SearchHeadInstanceType:
-        default: EC2 instance type for Splunk search head
-      KeyName:
-        default: Key Name
-      PublicSubnet1ID:
-        default: Public Subnet 1 ID
-      PublicSubnet2ID:
-        default: Public Subnet 2 ID
-      PublicSubnet3ID:
-        default: Public Subnet 3 ID
-      NumberOfAZs:
-        default: Number of Availability Zones
-      SHCEnabled:
-        default: Enable Search Head Cluster?
-      SSHClientLocation:
-        default: Permitted CIDR for ssh
-      SplunkAdminPassword:
-        default: Splunk Admin Password
-      SplunkIndexerCount:
-        default: No. of Splunk Indexers
-      SplunkIndexerDiskSize:
-        default: Indexer Disk Size
-      SplunkSearchHeadDiskSize:
-        default: Search Head(s) Disk Size
-      SplunkLicenseBucket:
-        default: Splunk License Bucket
-      SplunkLicensePath:
-        default: Splunk License S3 Bucket Path
-      SplunkReplicationFactor:
-        default: Index Cluster Replication Factor
-      SplunkSearchFactor:
-        default: Index Cluster Search Factor
-      SplunkClusterSecret:
-        default: Shared Security Key for Cluster Nodes
-      SplunkIndexerDiscoverySecret:
-        default: Shared Security Key for Forwarders using Indexer Discovery
-      IndexerApps:
-        default: Apps/Add-ons to pre-Install on Splunk Indexers
-      SearchHeadApps:
-        default: Apps/Add-ons to pre-Install on Splunk Search Heads
-      VPCCIDR:
-        default: VPC CIDR
-      VPCID:
-        default: VPC ID
+Description: Splunk deployment with indexer clustering, search head with optional search head clustering, and cluster manager/license server. (qs-1qup6ramp)
 Parameters:
   WebClientLocation:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to connect to the Splunk web
-      interface. Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: The IP address range that is allowed to connect to the Splunk web interface. Note that a value of 0.0.0.0/0 will allow access from ANY ip address
     MaxLength: '19'
     MinLength: '9'
     Type: String
   HECClientLocation:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to send data to Splunk HTTP
-      Event Collector. Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: The IP address range that is allowed to send data to Splunk HTTP Event Collector. Note that a value of 0.0.0.0/0 will allow access from ANY ip address
     MaxLength: '19'
     MinLength: '9'
     Type: String
   IndexerInstanceType:
     AllowedValues:
-      - c4.2xlarge
-      - c4.4xlarge
-      - c4.8xlarge
-      - m4.2xlarge
-      - m4.4xlarge
-      - m4.10xlarge
-      - c5.2xlarge
+      - m5.4xlarge
+      - m5.8xlarge
       - c5.4xlarge
       - c5.9xlarge
       - c5.18xlarge
-      - i3.2xlarge
       - i3.4xlarge
       - i3.8xlarge
+      - i3en.3xlarge
+      - i3en.6xlarge
+      - i3en.12xlarge
     Description: EC2 instance type for Splunk Indexers
-    ConstraintDescription: must be a valid EC2 instance type.
-    Default: c5.4xlarge
+    ConstraintDescription: Must be a valid EC2 instance type.
+    Default: i3.4xlarge
     Type: String
   SearchHeadInstanceType:
     AllowedValues:
-      - c4.2xlarge
-      - c4.4xlarge
-      - c4.8xlarge
-      - r4.4xlarge
-      - r4.8xlarge
-      - r4.16xlarge
-      - c5.2xlarge
+      - r5.4xlarge
+      - r5.8xlarge
+      - r5.16xlarge
       - c5.4xlarge
       - c5.9xlarge
       - m5.2xlarge
       - m5.4xlarge
+      - m5.8xlarge
       - m5.12xlarge
     Description: EC2 instance type for Splunk Search Heads
-    ConstraintDescription: must be a valid EC2 instance type.
+    ConstraintDescription: Must be a valid EC2 instance type.
     Default: c5.4xlarge
     Type: String
-  IndexerApps:
-    Description: Comma separated list of URLs of Splunk App (or Add-on) tarballs (.spl)
-      to pre-install on indexer(s)
-    Default: ''
-    Type: CommaDelimitedList
-  SearchHeadApps:
-    Description: Comma separated list of URLs of Splunk App (or Add-on) tarballs (.spl)
-      to pre-install on search head(s)
-    Default: ''
-    Type: CommaDelimitedList
   KeyName:
     ConstraintDescription: Must be the name of an existing EC2 KeyPair.
-    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
+    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance.
     Type: AWS::EC2::KeyPair::KeyName
   NumberOfAZs:
     AllowedValues:
       - '2'
       - '3'
     Default: '2'
-    Description: Number of Availability Zones to use in the VPC. This must match the
-      number public subnet IDs entered as parameters
+    Description: Number of Availability Zones to use in the VPC. This must match the number public subnet IDs entered as parameters.
     Type: String
   PublicSubnet1ID:
     Description: ID of Splunk public subnet 1 in Availability Zone 1 (e.g., subnet-xxxxxxxx)
@@ -187,15 +66,10 @@ Parameters:
   PublicSubnet3ID:
     Description: ID of Splunk public subnet 3 in Availability Zone 3 (e.g., subnet-xxxxxxxx)
     Type: AWS::EC2::Subnet::Id
-    Default: ''
   QSS3BucketName:
-    Default: splk-quickstart-testing
+    Default: aws-quickstart
     Description: S3 bucket name for the Quick Start assets.
     Type: String
-  QSS3BucketRegion:
-    Default: 'us-east-1'
-    Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
-    Type: String
   QSS3KeyPrefix:
     Default: quickstart-splunk-enterprise/
     Description: S3 key prefix for the Quick Start assets.
@@ -209,101 +83,186 @@ Parameters:
     Type: String
   SSHClientLocation:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0
-      for no restrictions.
-    Description: 'The IP address range that is allowed to SSH to the EC2 instances.
-      Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
+    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation.  Use 0.0.0.0/0 for no restrictions.
+    Description: The IP address range that is allowed to SSH to the EC2 instances. Note that a value of 0.0.0.0/0 will allow access from ANY ip address
     MaxLength: '19'
     MinLength: '9'
     Type: String
   SplunkAdminPassword:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: Admin password for Splunk. Must be at least 6 characters containing
-      letters, numbers and symbols.
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters, numbers and symbols.
+    Description: Admin password for Splunk. Must be at least 8 characters containing letters, numbers and symbols.
     MaxLength: '32'
-    MinLength: '6'
+    MinLength: '8'
     NoEcho: 'true'
     Type: String
   SplunkIndexerCount:
-    ConstraintDescription: must be a valid number, 3-10
-    Default: '3'
-    Description: How many Splunk indexers to launch.  [3-10]
+    ConstraintDescription: Must be a valid number, 4-10
+    Default: '4'
+    Description: How many Splunk indexers to launch.  [4-10]
     MaxValue: '10'
-    MinValue: '3'
+    MinValue: '4'
     Type: Number
   SplunkIndexerDiskSize:
-    ConstraintDescription: must be a valid number, 320-16000
-    Default: '320'
-    Description: The size of the attached EBS volume to the Splunk indexers.  (in
-      GB)
+    ConstraintDescription: Must be a valid number, 100-16000
+    Default: '300'
+    Description: The size of the attached EBS volume to the Splunk indexers.  (in GB)
     MaxValue: '16000'
-    MinValue: '320'
+    MinValue: '100'
     Type: Number
   SplunkSearchHeadDiskSize:
-    ConstraintDescription: must be a valid number, 320-16000
-    Default: '320'
-    Description: The size of the attached EBS volume to the Splunk search head(s).  (in
-      GB)
+    ConstraintDescription: Must be a valid number, 100-16000
+    Default: '300'
+    Description: The size of the attached EBS volume to the Splunk search head(s).  (in GB)
     MaxValue: '16000'
-    MinValue: '320'
+    MinValue: '100'
     Type: Number
-  SplunkLicenseBucket:
+  SmartStoreBucketName:
     Default: ''
-    Description: Name of private S3 bucket with licenses to be accessed via authenticated
-      requests
+    Description: Name of S3 bucket to be created for SmartStore storage
+    Type: String
+  SplunkLicenseBucket:
+    ConstraintDescription: Required for QuickStart to function and must be a valid s3 bucket
+    AllowedPattern: (?=^.{3,63}$)(?!xn--)([a-z0-9](?:[a-z0-9-]*)[a-z0-9])$
+    Description: Name of private S3 bucket with licenses to be accessed via authenticated requests
+    MinLength: '3'
+    MaxLength: '63'
     Type: String
   SplunkLicensePath:
-    Default: ''
-    Description: Path to license file in S3 Bucket (without leading '/')
+    ConstraintDescription: Required for QuickStart to function and must point to a valid Splunk license
+    AllowedPattern: ([0-9]|[A-Z]|[a-z]|[\/\._-])+
+    Description: Path to license file in S3 Bucket (without leading /)
+    MinLength: '1'
+    MaxLength: '128'
     Type: String
   SplunkReplicationFactor:
-    ConstraintDescription: must be a valid number, 2-4
+    ConstraintDescription: Must be a valid number, 2-6
     Default: '2'
     Description: How many copies of data should be stored in the Splunk Indexer Cluster
-    MaxValue: '4'
+    MaxValue: '6'
     MinValue: '2'
     Type: Number
   SplunkSearchFactor:
-    ConstraintDescription: must be a valid number, 2-4
+    ConstraintDescription: Must be a valid number, 2-6
     Default: '2'
-    Description: How many copies of data should be searchable in the Splunk indexer
-      clusters
-    MaxValue: '4'
+    Description: How many copies of data should be searchable in the Splunk indexer clusters
+    MaxValue: '6'
     MinValue: '2'
     Type: Number
   SplunkClusterSecret:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: Shared cluster secret for Search Head and Indexer cluster nodes.
-      Must be at least 8 characters containing letters, numbers and symbols.
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters, numbers and symbols.
+    Description: Shared cluster secret for Search Head and Indexer cluster nodes. Must be at least 8 characters containing letters, numbers and symbols.
     MaxLength: '32'
     MinLength: '8'
     NoEcho: 'true'
     Type: String
   SplunkIndexerDiscoverySecret:
-    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
-    ConstraintDescription: Must be at least 8 characters containing letters, numbers
-      and symbols.
-    Description: >-
-      Security key used for communication between your forwarders and the cluster
-      master. This value should also be used by forwarders in order to retrieve list
-      of available peer nodes from cluster master. Must be at least 8 characters containing
-      letters, numbers and symbols.
+    AllowedPattern: (?=.{8,})(?=.*[a-zA-Z])(?=.*[0-9]).*
+    ConstraintDescription: Must be at least 8 characters containing letters, numbers and symbols.
+    Description: Security key used for communication between your forwarders and the cluster manager. This value should also be used by forwarders in order to retrieve list of available peer nodes from cluster manager. Must be at least 8 characters containing letters, numbers and symbols.
     MaxLength: '32'
     MinLength: '8'
     NoEcho: 'true'
     Type: String
   VPCCIDR:
     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
-    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
+    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
     Description: VPC CIDR Block (x.x.x.x/x notation)
     Type: String
   VPCID:
     Description: VPC ID
     Type: AWS::EC2::VPC::Id
+Metadata:
+  AWSAMIRegionMap:
+    Filters:
+      SPLUNKENTHVM:
+        name: splunk_AMI*
+        owner-alias: aws-marketplace
+        product-code.type: marketplace
+  QuickStartDocumentation:
+    EntrypointName: "Splunk QuickStart (Existing VPC)"
+  AWS::CloudFormation::Interface:
+    ParameterGroups:
+      - Label:
+          default: AWS Instance and Network Settings
+        Parameters:
+          - IndexerInstanceType
+          - SearchHeadInstanceType
+          - KeyName
+          - WebClientLocation
+          - HECClientLocation
+          - SSHClientLocation
+          - VPCID
+          - VPCCIDR
+          - PublicSubnet1ID
+          - PublicSubnet2ID
+          - PublicSubnet3ID
+          - NumberOfAZs
+      - Label:
+          default: Splunk Settings
+        Parameters:
+          - SplunkAdminPassword
+          - SplunkClusterSecret
+          - SplunkIndexerDiscoverySecret
+          - SplunkLicenseBucket
+          - SplunkLicensePath
+          - SplunkIndexerCount
+          - SplunkIndexerDiskSize
+          - SplunkSearchHeadDiskSize
+          - SplunkReplicationFactor
+          - SplunkSearchFactor
+          - SmartStoreBucketName
+          - SHCEnabled
+    ParameterLabels:
+      WebClientLocation:
+        default: Permitted CIDR for Splunk web interface
+      HECClientLocation:
+        default: Permitted CIDR for Splunk HTTP event collector input
+      IndexerInstanceType:
+        default: EC2 instance type for Splunk indexer
+      SearchHeadInstanceType:
+        default: EC2 instance type for Splunk search head
+      KeyName:
+        default: Key Name
+      PublicSubnet1ID:
+        default: Public Subnet 1 ID
+      PublicSubnet2ID:
+        default: Public Subnet 2 ID
+      PublicSubnet3ID:
+        default: Public Subnet 3 ID
+      NumberOfAZs:
+        default: Number of Availability Zones
+      SHCEnabled:
+        default: Enable Search Head Cluster?
+      SSHClientLocation:
+        default: Permitted CIDR for ssh
+      SplunkAdminPassword:
+        default: Splunk Admin Password
+      SplunkIndexerCount:
+        default: No. of Splunk Indexers
+      SmartStoreBucketName:
+        default: Name of bucket to be created for Smartstore storage
+      SplunkIndexerDiskSize:
+        default: Indexer Disk Size
+      SplunkSearchHeadDiskSize:
+        default: Search Head(s) Disk Size
+      SplunkLicenseBucket:
+        default: Splunk License Bucket
+      SplunkLicensePath:
+        default: Splunk License S3 Bucket Path
+      SplunkReplicationFactor:
+        default: Index Cluster Replication Factor
+      SplunkSearchFactor:
+        default: Index Cluster Search Factor
+      SplunkClusterSecret:
+        default: Shared Security Key for Cluster Nodes
+      SplunkIndexerDiscoverySecret:
+        default: Shared Security Key for Forwarders using Indexer Discovery
+      VPCCIDR:
+        default: VPC CIDR
+      VPCID:
+        default: VPC ID
 Conditions:
   Create3AZ: !Equals
     - !Ref 'NumberOfAZs'
@@ -314,18 +273,6 @@ Conditions:
   CreateSHC: !Equals
     - !Ref 'SHCEnabled'
     - 'yes'
-  InstallIndexerApps: !Not
-    - !Equals
-      - !Join
-        - ''
-        - !Ref 'IndexerApps'
-      - ''
-  InstallSearchHeadApps: !Not
-    - !Equals
-      - !Join
-        - ''
-        - !Ref 'SearchHeadApps'
-      - ''
   ConfigureLicense: !And
     - !Not
       - !Equals
@@ -335,55 +282,113 @@ Conditions:
       - !Equals
         - ''
         - !Ref 'SplunkLicensePath'
-  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
 Mappings:
   AWSAMIRegionMap:
     AMI:
-      SPLUNKENTHVM: splunk_marketplace_AMI_2018-10-16_22_07_36-7b65de6c-5006-4ca2-bd75-fdba95ae5d9d-ami-0d494b5a999e1c49f.4
+      SPLUNKENTHVM: splunk_AMI_8.2.6_2022-04-20_17-27-55-7b65de6c-5006-4ca2-bd75-fdba95ae5d9d
+    us-west-1:
+      SPLUNKENTHVM: ami-083c40352f95a2a8d
+    us-west-2:
+      SPLUNKENTHVM: ami-063db914927fd068a
+    us-east-1:
+      SPLUNKENTHVM: ami-02be4afccabbc98a7
+    us-east-2:
+      SPLUNKENTHVM: ami-0e3657d8025d1f571
+    ap-south-1:
+      SPLUNKENTHVM: ami-04f8e05450860a0e4
     ap-northeast-1:
-      SPLUNKENTHVM: ami-0db36f11d65f551fb
+      SPLUNKENTHVM: ami-0316ee1a35129c1ed
     ap-northeast-2:
-      SPLUNKENTHVM: ami-09c7965888207979b
-    ap-south-1:
-      SPLUNKENTHVM: ami-07c20db6edfd45f98
+      SPLUNKENTHVM: ami-0441f1c60fa588b30
     ap-southeast-1:
-      SPLUNKENTHVM: ami-0e7b7ca1bdcdd93a6
+      SPLUNKENTHVM: ami-0066d2b4e4446b6b4
     ap-southeast-2:
-      SPLUNKENTHVM: ami-0c8a4d5bdf83f0df8
+      SPLUNKENTHVM: ami-0b93708f93e6fcefa
     ca-central-1:
-      SPLUNKENTHVM: ami-02f085f4514fa7145
+      SPLUNKENTHVM: ami-0287afc9fe6de24dc
     eu-central-1:
-      SPLUNKENTHVM: ami-09ce965c3b1a9a1cb
+      SPLUNKENTHVM: ami-0258ed74a65c3aa80
     eu-west-1:
-      SPLUNKENTHVM: ami-0fafe9e81915f154e
+      SPLUNKENTHVM: ami-0ef490267313f2958
     eu-west-2:
-      SPLUNKENTHVM: ami-060d9e50d310e0ebb
+      SPLUNKENTHVM: ami-0eed7148a3c5db6a0
+    eu-west-3:
+      SPLUNKENTHVM: ami-0f8ed68391019e14a
+    eu-north-1:
+      SPLUNKENTHVM: ami-0c13450402b8e9f7a
     sa-east-1:
-      SPLUNKENTHVM: ami-0dacd4005280936e5
-    us-east-1:
-      SPLUNKENTHVM: ami-0484972f36720ea7f
-    us-east-2:
-      SPLUNKENTHVM: ami-04b6874c649721f0a
-    us-west-1:
-      SPLUNKENTHVM: ami-0377011a3f771e353
-    us-west-2:
-      SPLUNKENTHVM: ami-0c3e33232b6c07537
+      SPLUNKENTHVM: ami-02f1a54ae0463d7ac
   SplunkConfig:
     dedicated-instance-type:
-      clusterMaster: c5.xlarge
+      clusterManager: c5.xlarge
       shclusterDeployer: c5.xlarge
     shcluster-replication-factor:
       num: '3'
     labels:
       cluster: IndexerCluster
       shcluster: SearchHeadCluster
+
 Resources:
+  SplunkSmartstoreBucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: !Ref 'SmartStoreBucketName'
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+    DeletionPolicy: Delete
+  SmartStoreS3BucketRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - ec2.amazonaws.com
+            Action:
+              - sts:AssumeRole
+      Path: /
+  SmartStoreS3AccessInstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      Path: /
+      Roles:
+        - !Ref 'SmartStoreS3BucketRole'
+  SmartStoreS3BucketPolicy:
+    Type: AWS::IAM::Policy
+    Properties:
+      PolicyName: SmartStoreS3BucketPolicy
+      PolicyDocument:
+        Statement:
+          - Action:
+              - s3:ListBucket
+            Effect: Allow
+            Resource:
+              - !Join
+                - ''
+                - - 'arn:aws:s3:::'
+                  - !Ref 'SmartStoreBucketName'
+          - Action:
+              - s3:PutObject
+              - s3:GetObject
+              - s3:DeleteObject
+              - s3:PutObjectAcl
+            Effect: Allow
+            Resource:
+              - !Join
+                - ''
+                - - 'arn:aws:s3:::'
+                  - !Ref 'SmartStoreBucketName'
+                  - '/*'
+      Roles:
+        - !Ref 'SmartStoreS3BucketRole'
   SplunkSearchHeadSecurityGroup:
     Type: AWS::EC2::SecurityGroup
     Properties:
       VpcId: !Ref 'VPCID'
-      GroupDescription: Enable port 8000 for Splunk web interface, port 8090 for SHC
-        replication, and port 8191 for KV store replication
+      GroupDescription: Enable port 8000 for Splunk web interface, port 8090 for SHC replication, and port 8191 for KV store replication
       SecurityGroupIngress:
         - IpProtocol: tcp
           FromPort: 8000
@@ -406,8 +411,7 @@ Resources:
     Type: AWS::EC2::SecurityGroup
     Properties:
       VpcId: !Ref 'VPCID'
-      GroupDescription: Enable port 9997 for splunktcp input, port 8088 for HEC input,
-        port 514 for tcp/udp input, and port 9887 for data replication
+      GroupDescription: Enable port 9997 for splunktcp input, port 8088 for HEC input, port 514 for tcp/udp input, and port 9887 for data replication
       SecurityGroupIngress:
         - IpProtocol: tcp
           FromPort: 9997
@@ -438,8 +442,7 @@ Resources:
     Type: AWS::EC2::SecurityGroup
     Properties:
       VpcId: !Ref 'VPCID'
-      GroupDescription: Enable administrative ports like restricted SSH and management
-        port
+      GroupDescription: Enable administrative ports like restricted SSH and management port
       SecurityGroupIngress:
         - IpProtocol: tcp
           FromPort: 22
@@ -474,7 +477,30 @@ Resources:
     Condition: CreateSingleSearchHead
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT15M
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       ImageId: !FindInMap
         - AWSAMIRegionMap
@@ -500,123 +526,44 @@ Resources:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkSearchHeadDiskSize'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n"
-            - "hostname splunksearch\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "service splunk restart\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Forward to indexer cluster using indexer discovery\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end\n"
-            - "# Turn off indexing on the search head\n"
-            - "[indexAndForward]\n"
-            - "index = false\n"
-            - "\n"
-            - "[tcpout]\n"
-            - "defaultGroup = indexer_cluster_peers\n"
-            - "forwardedindex.filter.disable = true\n"
-            - "indexAndForward = false\n"
-            - "\n"
-            - "[tcpout:indexer_cluster_peers]\n"
-            - "indexerDiscovery = cluster_master\n"
-            - "\n"
-            - "[indexer_discovery:cluster_master]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkIndexerDiscoverySecret'
-            - "\n"
-            - master_uri = https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ":8089\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated\n"
-            - "service splunk start\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave -master_uri
-              https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -secret '
-            - !Ref 'SplunkClusterSecret'
-            - ' -mode searchhead -site site1 -master_uri https://'
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - !If
-              - InstallSearchHeadApps
-              - !Join
-                - ''
-                - - "# Add user-provided apps for cluster members\n"
-                  - 'user_apps=( '
-                  - !Join
-                    - ' '
-                    - !Ref 'SearchHeadApps'
-                  - " )\n"
-                  - "for i in ${!user_apps[*]}\n"
-                  - "do\n"
-                  - "   echo \"Downloading app ${user_apps[$i]}\"\n"
-                  - "   if wget --tries=3 ${user_apps[$i]} -O /tmp/app${i}.spl; then\n"
-                  - "        echo \"Installing app...\"\n"
-                  - "        tar -xvzf /tmp/app${i}.spl -C $SPLUNK_HOME/etc/apps/\n"
-                  - "        if [ $? -ne 0 ]; then\n"
-                  - "            echo \"Extracting tarball failed\"\n"
-                  - "        fi\n"
-                  - "        rm /tmp/app${i}.spl\n"
-                  - "    else\n"
-                  - "        echo \"Downloading tarball failed\"\n"
-                  - "    fi\n"
-                  - "done\n"
-                  - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps\n"
-              - ''
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkSearchHeadInstance'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+        Fn::Base64:
+          Fn::Sub:
+            - |
+              #!/bin/bash -xe
+              ## prevent cloud-init scripts from running
+              mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+              rm -f /var/lib/cloud/instance/scripts/runcmd
+              export INSTALL_LICENSE="1"
+              export RESOURCE="SplunkSearchHeadInstance"
+              export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+              export ADMIN_PASSWORD="${SplunkAdminPassword}"
+              export STACK_NAME="${AWS::StackName}"
+              export AWS_REGION="${AWS::Region}"
+              export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+              export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+              export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+              export CM_PRIVATEIP="${SplunkCMIP}"
+              yum -y install aws-cfn-bootstrap 
+              ## required python modules for ansible to function
+              python3 -m pip install requests pyyaml
+              /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+              chmod +x /tmp/user_data.sh
+              /tmp/user_data.sh single_sh 
+            - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
   SplunkCM:
     Type: AWS::EC2::Instance
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT15M
     Metadata:
       AWS::CloudFormation::Init: !If
         - ConfigureLicense
         - config:
             files:
-              /etc/splunk/splunk.license:
+              /tmp/splunk.license:
                 source: !If
                   - ConfigureLicense
                   - !Join
@@ -630,6 +577,21 @@ Resources:
                 owner: splunk
                 group: splunk
                 authentication: S3AccessCreds
+              /tmp/user_data.sh:
+                source: !If
+                  - ConfigureLicense
+                  - !Join 
+                    - ''
+                    - - https://
+                      - !Ref 'QSS3BucketName'
+                      - .s3.amazonaws.com/
+                      - !Ref 'QSS3KeyPrefix'
+                      - scripts/user_data.sh
+                  - !Ref 'AWS::NoValue'
+                mode: '000755'
+                owner: root 
+                group: root
+                authentication: S3AccessCreds
         - !Ref 'AWS::NoValue'
       AWS::CloudFormation::Authentication: !If
         - ConfigureLicense
@@ -639,13 +601,14 @@ Resources:
             secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
             buckets:
               - !Ref 'SplunkLicenseBucket'
+              - !Ref 'QSS3BucketName'
         - !Ref 'AWS::NoValue'
     Properties:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
-            VolumeSize: 50
+            VolumeType: gp3
+            VolumeSize: 300
       NetworkInterfaces:
         - GroupSet:
             - !Ref 'SplunkSecurityGroup'
@@ -661,171 +624,43 @@ Resources:
       InstanceType: !FindInMap
         - SplunkConfig
         - dedicated-instance-type
-        - clusterMaster
+        - clusterManager
       KeyName: !Ref 'KeyName'
       Tags:
         - Key: Application
           Value: !Ref 'AWS::StackId'
         - Key: Role
-          Value: cluster-master
+          Value: cluster-manager
         - Key: Name
-          Value: cluster-master
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id\
-              \ 2>/dev/null)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "# remove stale splunkd.log that ships with AMI.\n"
-            - "rm -f $SPLUNK_HOME/var/log/splunk/splunkd.log\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunklicense' >> /etc/hosts\n"
-            - "hostname splunklicense\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "service splunk restart\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password '
-            - !Ref 'SplunkAdminPassword'
-            - " -role admin -auth admin:$INSTANCEID\n"
-            - "service splunk restart\n"
-            - "# Install files from the metadata\n"
-            - '/opt/aws/bin/cfn-init -v '
-            - '         --stack '
-            - !Ref 'AWS::StackName'
-            - '         --resource SplunkCM'
-            - '         --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "mkdir -p $SPLUNK_HOME/etc/licenses/enterprise\n"
-            - "chown $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/licenses/enterprise\n"
-            - "mv /etc/splunk/splunk.license $SPLUNK_HOME/etc/licenses/enterprise/\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Forward to indexer cluster using indexer discovery\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end\n"
-            - "# Turn off indexing\n"
-            - "[indexAndForward]\n"
-            - "index = false\n"
-            - "\n"
-            - "[tcpout]\n"
-            - "defaultGroup = indexer_cluster_peers\n"
-            - "forwardedindex.filter.disable = true\n"
-            - "indexAndForward = false\n"
-            - "\n"
-            - "[tcpout:indexer_cluster_peers]\n"
-            - "indexerDiscovery = cluster_master\n"
-            - "\n"
-            - "[indexer_discovery:cluster_master]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkIndexerDiscoverySecret'
-            - "\n"
-            - "master_uri = https://127.0.0.1:8089\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated\n"
-            - "service splunk restart\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN login -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode master -multisite
-              true -replication_factor '
-            - !Ref 'SplunkReplicationFactor'
-            - ' -available_sites '
-            - !If
-              - Create3AZ
-              - site1,site2,site3
-              - site1,site2
-            - ' -site site1'
-            - ' -site_replication_factor origin:1,total:'
-            - !Ref 'SplunkReplicationFactor'
-            - ' -site_search_factor origin:1,total:'
-            - !Ref 'SplunkSearchFactor'
-            - ' -secret '
-            - !Ref 'SplunkClusterSecret'
-            - ' -cluster_label SplunkIndexersASG'
-            - "\n"
-            - "# Configure indexer discovery\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end\n"
-            - "\n"
-            - "[indexer_discovery]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkIndexerDiscoverySecret'
-            - "\n"
-            - "indexerWeightByDiskCapacity = true\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local/server.conf\n"
-            - "# Add base configs for peer nodes as an app under master-apps\n"
-            - "# Peer config 1: Enable HEC input\n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN http-event-collector enable -uri https://localhost:8089\n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN http-event-collector create default-token\
-              \ -uri https://localhost:8089 > /tmp/token\n"
-            - "TOKEN=`sed -n 's/\\ttoken=//p' /tmp/token` && rm /tmp/token\n"
-            - "echo $TOKEN\n"
-            - "mkdir -p $SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local\n"
-            - "mv $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf $SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local\n"
-            - "# Peer config 2: Enable splunktcp input\n"
-            - "cat >>$SPLUNK_HOME/etc/master-apps/peer-base-autogenerated/local/inputs.conf\
-              \ <<end\n"
-            - "\n"
-            - "[splunktcp://9997]\n"
-            - "disabled=0\n"
-            - "end\n"
-            - !If
-              - InstallIndexerApps
-              - !Join
-                - ''
-                - - "# Add user-provided apps for peer nodes\n"
-                  - 'user_apps=( '
-                  - !Join
-                    - ' '
-                    - !Ref 'IndexerApps'
-                  - " )\n"
-                  - "for i in ${!user_apps[*]}\n"
-                  - "do\n"
-                  - "   echo \"Downloading app ${user_apps[$i]}\"\n"
-                  - "   if wget --tries=3 ${user_apps[$i]} -O /tmp/app${i}.spl; then\n"
-                  - "        echo \"Installing app...\"\n"
-                  - "        tar -xvzf /tmp/app${i}.spl -C $SPLUNK_HOME/etc/master-apps/\n"
-                  - "        if [ $? -ne 0 ]; then\n"
-                  - "            echo \"Extracting tarball failed\"\n"
-                  - "        fi\n"
-                  - "        rm /tmp/app${i}.spl\n"
-                  - "    else\n"
-                  - "        echo \"Downloading tarball failed\"\n"
-                  - "    fi\n"
-                  - "done\n"
-              - ''
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/master-apps\n"
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkCM'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - /opt/aws/bin/cfn-signal -e 0 -i token -d "$TOKEN" '
-            - !Ref 'SplunkCMWaitHandle'
-            - "'\n"
-            - "usermod --expiredate 1 splunk\n"
+          Value: cluster-manager
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export SITELIST="${Sitelist}"
+            export RESOURCE="SplunkCM"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh cm 
+          - Sitelist: !If [Create3AZ, "site1,site2,site3", "site1,site2" ]
   SplunkCMWaitHandle:
     Type: AWS::CloudFormation::WaitConditionHandle
   SplunkCMWaitCondition:
@@ -833,13 +668,36 @@ Resources:
     DependsOn: SplunkCM
     Properties:
       Handle: !Ref 'SplunkCMWaitHandle'
-      Timeout: '3600'
+      Timeout: '900'
   SplunkSHCDeployer:
     Type: AWS::EC2::Instance
     Condition: CreateSHC
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT10M
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       ImageId: !FindInMap
         - AWSAMIRegionMap
@@ -854,7 +712,7 @@ Resources:
         - Key: Application
           Value: !Ref 'AWS::StackId'
         - Key: Role
-          Value: splunk-search-head
+          Value: splunk-deployer
         - Key: Name
           Value: deployer
       NetworkInterfaces:
@@ -868,147 +726,65 @@ Resources:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkSearchHeadDiskSize'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunk-shc-deployer' >> /etc/hosts\n"
-            - "hostname splunk-shc-deployer\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "service splunk restart\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Configure some SHC parameters\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/server.conf <<end\n"
-            - "\n"
-            - "[shclustering]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkClusterSecret'
-            - "\n"
-            - "shcluster_label = SplunkSHC\n"
-            - "end\n"
-            - "# Forward to indexer cluster using indexer discovery\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/outputs.conf <<end\n"
-            - "# Turn off indexing on the search head\n"
-            - "[indexAndForward]\n"
-            - "index = false\n"
-            - "\n"
-            - "[tcpout]\n"
-            - "defaultGroup = indexer_cluster_peers\n"
-            - "forwardedindex.filter.disable = true\n"
-            - "indexAndForward = false\n"
-            - "\n"
-            - "[tcpout:indexer_cluster_peers]\n"
-            - "indexerDiscovery = cluster_master\n"
-            - "\n"
-            - "[indexer_discovery:cluster_master]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkIndexerDiscoverySecret'
-            - "\n"
-            - master_uri = https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ":8089\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated\n"
-            - "# Add base config for search head cluster members\n"
-            - "mkdir -p $SPLUNK_HOME/etc/shcluster/apps/member-base-autogenerated/local\n"
-            - "cat >>$SPLUNK_HOME/etc/shcluster/apps/member-base-autogenerated/local/outputs.conf\
-              \ <<end\n"
-            - "# Turn off indexing on the search head\n"
-            - "[indexAndForward]\n"
-            - "index = false\n"
-            - "\n"
-            - "[tcpout]\n"
-            - "defaultGroup = indexer_cluster_peers\n"
-            - "forwardedindex.filter.disable = true\n"
-            - "indexAndForward = false\n"
-            - "\n"
-            - "[tcpout:indexer_cluster_peers]\n"
-            - "indexerDiscovery = cluster_master\n"
-            - "\n"
-            - "[indexer_discovery:cluster_master]\n"
-            - 'pass4SymmKey = '
-            - !Ref 'SplunkIndexerDiscoverySecret'
-            - "\n"
-            - master_uri = https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ":8089\n"
-            - "end\n"
-            - !If
-              - InstallSearchHeadApps
-              - !Join
-                - ''
-                - - "# Add user-provided apps for cluster members\n"
-                  - 'user_apps=( '
-                  - !Join
-                    - ' '
-                    - !Ref 'SearchHeadApps'
-                  - " )\n"
-                  - "for i in ${!user_apps[*]}\n"
-                  - "do\n"
-                  - "   echo \"Downloading app ${user_apps[$i]}\"\n"
-                  - "   if wget --tries=3 ${user_apps[$i]} -O /tmp/app${i}.spl; then\n"
-                  - "        echo \"Installing app...\"\n"
-                  - "        tar -xvzf /tmp/app${i}.spl -C $SPLUNK_HOME/etc/shcluster/apps/\n"
-                  - "        if [ $? -ne 0 ]; then\n"
-                  - "            echo \"Extracting tarball failed\"\n"
-                  - "        fi\n"
-                  - "        rm /tmp/app${i}.spl\n"
-                  - "    else\n"
-                  - "        echo \"Downloading tarball failed\"\n"
-                  - "    fi\n"
-                  - "done\n"
-              - ''
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/shcluster/apps\n"
-            - "service splunk start\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave '
-            - -master_uri https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN apply shcluster-bundle -action stage\
-              \ --answer-yes\n"
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkSHCDeployer'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export RESOURCE="SplunkSHCDeployer"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh deployer 
+          - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
   SplunkSHCMember1:
     Type: AWS::EC2::Instance
     Condition: CreateSHC
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT10M
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       ImageId: !FindInMap
         - AWSAMIRegionMap
@@ -1034,94 +810,71 @@ Resources:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkSearchHeadDiskSize'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n"
-            - "hostname splunksearch\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "# set splunk servername \n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername SHC1\n"
-            - "service splunk restart\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Configure some SHC parameters\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end\n"
-            - "[shclustering]\n"
-            - "register_replication_address = $LOCALIP\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local\n"
-            - "service splunk restart\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave '
-            - -master_uri https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN init shcluster-config '
-            - '-mgmt_uri https://$LOCALIP:8089 -replication_port 8090 -replication_factor '
-            - !FindInMap
-              - SplunkConfig
-              - shcluster-replication-factor
-              - num
-            - ' -conf_deploy_fetch_url https://'
-            - !GetAtt 'SplunkSHCDeployer.PrivateIp'
-            - ':8089 '
-            - '-shcluster_label SplunkSHC '
-            - '-secret '
-            - !Ref 'SplunkClusterSecret'
-            - ' '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode searchhead
-            - ' -site site1'
-            - ' -master_uri https://'
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - ' -secret '
-            - !Ref 'SplunkClusterSecret'
-            - "\n"
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkSHCMember1'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export SH_REPLICATION_FACTOR="${SplunkReplicationFactor}"
+            export THREEAZ="${THREEAZ}"
+            export SH_DEPLOYER_IP="${SH_DEPLOYER_IP}"
+            ####
+            export RESOURCE="SplunkSHCMember1"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh cluster_sh 1 
+          - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
+            SH_DEPLOYER_IP: !GetAtt SplunkSHCDeployer.PrivateIp
+            THREEAZ: !If [ Create3AZ, "1", "0" ]
   SplunkSHCMember2:
     Type: AWS::EC2::Instance
     Condition: CreateSHC
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT10M
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       ImageId: !FindInMap
         - AWSAMIRegionMap
@@ -1147,94 +900,70 @@ Resources:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkSearchHeadDiskSize'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n"
-            - "hostname splunksearch\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "# set splunk servername \n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername SHC2\n"
-            - "service splunk restart\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Configure some SHC parameters\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end\n"
-            - "[shclustering]\n"
-            - "register_replication_address = $LOCALIP\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local\n"
-            - "service splunk start\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave '
-            - -master_uri https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN init shcluster-config '
-            - '-mgmt_uri https://$LOCALIP:8089 -replication_port 8090 -replication_factor '
-            - !FindInMap
-              - SplunkConfig
-              - shcluster-replication-factor
-              - num
-            - ' -conf_deploy_fetch_url https://'
-            - !GetAtt 'SplunkSHCDeployer.PrivateIp'
-            - ':8089 '
-            - '-shcluster_label SplunkSHC '
-            - '-secret '
-            - !Ref 'SplunkClusterSecret'
-            - ' '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode searchhead
-            - ' -site site2'
-            - ' -master_uri https://'
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - ' -secret '
-            - !Ref 'SplunkClusterSecret'
-            - "\n"
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkSHCMember2'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export SH_REPLICATION_FACTOR="${SplunkReplicationFactor}"
+            export THREEAZ="${THREEAZ}"
+            export SH_DEPLOYER_IP="${SH_DEPLOYER_IP}"
+            export RESOURCE="SplunkSHCMember2"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh cluster_sh 2 
+          - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
+            SH_DEPLOYER_IP: !GetAtt SplunkSHCDeployer.PrivateIp
+            THREEAZ: !If [ Create3AZ, "1", "0" ]
   SplunkSHCMember3:
     Type: AWS::EC2::Instance
     Condition: CreateSHC
     CreationPolicy:
       ResourceSignal:
-        Timeout: PT60M
+        Timeout: PT10M
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       ImageId: !FindInMap
         - AWSAMIRegionMap
@@ -1263,119 +992,51 @@ Resources:
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkSearchHeadDiskSize'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n"
-            - "hostname splunksearch\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "# set splunk servername \n"
-            - "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername SHC3\n"
-            - "service splunk restart\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password '
-            - !Ref 'SplunkAdminPassword'
-            - " -role admin -auth admin:$INSTANCEID\n"
-            - "service splunk restart\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Configure some SHC parameters\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/server.conf <<end\n"
-            - "[shclustering]\n"
-            - "register_replication_address = $LOCALIP\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/system/local\n"
-            - "service splunk start\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave '
-            - -master_uri https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN init shcluster-config '
-            - '-mgmt_uri https://$LOCALIP:8089 -replication_port 8090 -replication_factor '
-            - !FindInMap
-              - SplunkConfig
-              - shcluster-replication-factor
-              - num
-            - ' -conf_deploy_fetch_url https://'
-            - !GetAtt 'SplunkSHCDeployer.PrivateIp'
-            - ':8089 '
-            - '-shcluster_label SplunkSHC '
-            - '-secret '
-            - !Ref 'SplunkClusterSecret'
-            - ' '
-            - '-auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode searchhead
-            - ' -site '
-            - !If
-              - Create3AZ
-              - site3
-              - site2
-            - ' -master_uri https://'
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - ' -secret '
-            - !Ref 'SplunkClusterSecret'
-            - "\n"
-            - "service splunk restart\n"
-            - "# Bootstrap SHC captain\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN bootstrap shcluster-captain '
-            - -servers_list "
-            - https://
-            - !GetAtt 'SplunkSHCMember1.PrivateIp'
-            - :8089,
-            - https://
-            - !GetAtt 'SplunkSHCMember2.PrivateIp'
-            - :8089,
-            - https://
-            - $LOCALIP
-            - :8089"
-            - ' -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - '/opt/aws/bin/cfn-signal -e $? --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkSHCMember3'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export SH_REPLICATION_FACTOR="${SplunkReplicationFactor}"
+            export THREEAZ="${THREEAZ}"
+            export SH_DEPLOYER_IP="${SH_DEPLOYER_IP}"
+            export SH1_IP=${SH1_IP}
+            export SH2_IP=${SH2_IP}
+            export RESOURCE="SplunkSHCMember2"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh cluster_sh 3 
+          - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
+            SH_DEPLOYER_IP: !GetAtt SplunkSHCDeployer.PrivateIp
+            SH1_IP: !GetAtt SplunkSHCMember1.PrivateIp
+            SH2_IP: !GetAtt SplunkSHCMember2.PrivateIp
+            THREEAZ: !If [ Create3AZ, "1", "0" ]
   CfnUser:
     Type: AWS::IAM::User
-    Condition: ConfigureLicense
     Properties:
       Path: /
   CfnKeys:
     Type: AWS::IAM::AccessKey
-    Condition: ConfigureLicense
     Properties:
       UserName: !Ref 'CfnUser'
   BucketPolicy:
@@ -1398,14 +1059,60 @@ Resources:
             Principal:
               AWS: !GetAtt 'CfnUser.Arn'
       Bucket: !Ref 'SplunkLicenseBucket'
+  UserDataBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      PolicyDocument:
+        Version: '2012-10-17'
+        Id: MyPolicy
+        Statement:
+          - Sid: ReadAccess
+            Action:
+              - s3:GetObject
+            Effect: Allow
+            Resource: !Join
+              - ''
+              - - 'arn:aws:s3:::'
+                - !Ref QSS3BucketName
+                - /
+                - !Ref QSS3KeyPrefix
+                - scripts/*
+            Principal:
+              AWS: !GetAtt 'CfnUser.Arn'
+      Bucket: !Ref 'QSS3BucketName'
+ 
   SplunkIndexerLaunchConfiguration:
     Type: AWS::AutoScaling::LaunchConfiguration
+    Metadata:
+      AWS::CloudFormation::Init: 
+        config:
+          files: 
+            /tmp/user_data.sh:
+              source: !Join 
+                  - ''
+                  - - https://
+                    - !Ref 'QSS3BucketName'
+                    - .s3.amazonaws.com/
+                    - !Ref 'QSS3KeyPrefix'
+                    - scripts/user_data.sh
+              mode: '000755'
+              owner: root 
+              group: root
+              authentication: S3AccessCreds
+      AWS::CloudFormation::Authentication: 
+         S3AccessCreds:
+          type: S3
+          accessKeyId: !Ref 'CfnKeys'
+          secretKey: !GetAtt 'CfnKeys.SecretAccessKey'
+          buckets:
+            - !Ref 'QSS3BucketName'
     Properties:
       AssociatePublicIpAddress: true
+      IamInstanceProfile: !Ref 'SmartStoreS3AccessInstanceProfile'
       BlockDeviceMappings:
         - DeviceName: /dev/xvda
           Ebs:
-            VolumeType: gp2
+            VolumeType: gp3
             VolumeSize: !Ref 'SplunkIndexerDiskSize'
       SecurityGroups:
         - !Ref 'SplunkSecurityGroup'
@@ -1416,93 +1123,40 @@ Resources:
         - SPLUNKENTHVM
       InstanceType: !Ref 'IndexerInstanceType'
       KeyName: !Ref 'KeyName'
-      UserData: !Base64
-        Fn::Join:
-          - ''
-          - - "#!/bin/bash -v\n"
-            - "# First make cloud-init output log readable by root only to protect\
-              \ sensitive parameter values\n"
-            - "chmod 600 /var/log/cloud-init-output.log\n"
-            - "yum update -y aws-cfn-bootstrap\n"
-            - "export LOCALIP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\n"
-            - "export INSTANCEID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n"
-            - "export SPLUNK_USER=splunk\n"
-            - "export SPLUNK_BIN=/opt/splunk/bin/splunk\n"
-            - "export SPLUNK_HOME=/opt/splunk\n"
-            - "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n"
-            - "cat >>$SPLUNK_HOME/etc/system/local/user-seed.conf <<end\n"
-            - "[user_info]\n"
-            - "USERNAME = admin\n"
-            - 'PASSWORD = '
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "end\n"
-            - "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n"
-            - "sed -i 's/ENFORCE_PWD_CHANGE=1/ENFORCE_PWD_CHANGE=0/' /etc/init.d/splunk\n"
-            - "touch $SPLUNK_HOME/etc/.ui_login\n"
-            - "service splunk restart\n"
-            - "# set splunk server name to local hostname.\n"
-            - 'sudo -u $SPLUNK_USER $SPLUNK_BIN set servername $HOSTNAME -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "# Increase splunkweb connection timeout with splunkd\n"
-            - "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n"
-            - "[settings]\n"
-            - "splunkdConnectionTimeout = 300\n"
-            - "end\n"
-            - "# Configure some SHC parameters\n"
-            - "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/server.conf <<end\n"
-            - "[shclustering]\n"
-            - "register_replication_address = ${LOCALIP}\n"
-            - "end\n"
-            - "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/apps/base-autogenerated\n"
-            - "service splunk start\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave -master_uri
-              https://
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 -auth admin:'
-            - !Ref 'SplunkAdminPassword'
-            - "\n"
-            - "export INSTANCE_MAC_ADDR=$(curl -s http://169.254.169.254/latest/meta-data/mac)\n"
-            - "export INSTANCE_SUBNET_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/$INSTANCE_MAC_ADDR/subnet-id)\n"
-            - "case $INSTANCE_SUBNET_ID in\n"
-            - '  '
-            - !Ref 'PublicSubnet1ID'
-            - ")\n"
-            - "    site=\"site1\"\n"
-            - "    ;;\n"
-            - '  '
-            - !Ref 'PublicSubnet2ID'
-            - ")\n"
-            - "    site=\"site2\"\n"
-            - "    ;;\n"
-            - '  '
-            - !Ref 'PublicSubnet3ID'
-            - ")\n"
-            - "    site=\"site3\"\n"
-            - "    ;;\n"
-            - "  *)\n"
-            - "    echo \"Unexpected subnet id\"\n"
-            - "    exit 1\n"
-            - "esac\n"
-            - sudo -u $SPLUNK_USER $SPLUNK_BIN edit cluster-config -mode slave
-            - ' -site $site'
-            - ' -master_uri https://'
-            - !GetAtt 'SplunkCM.PrivateIp'
-            - ':8089 '
-            - ' -replication_port 9887'
-            - ' -secret '
-            - !Ref 'SplunkClusterSecret'
-            - "\n"
-            - "service splunk restart\n"
-            - '/opt/aws/bin/cfn-signal -s true --stack '
-            - !Ref 'AWS::StackName'
-            - ' --resource SplunkIndexerNodesASG'
-            - ' --region '
-            - !Ref 'AWS::Region'
-            - "\n"
-            - "usermod --expiredate 1 splunk\n"
+      UserData:
+       Fn::Base64:
+        Fn::Sub:
+          - |
+            #!/bin/bash -xe
+            ## prevent cloud-init scripts from running
+            mv /etc/cloud/cloud.cfg.d/*splunk* /tmp
+            rm -f /var/lib/cloud/instance/scripts/runcmd
+            export INSTALL_LICENSE="1"
+            export SYMMKEY="${SplunkIndexerDiscoverySecret}"
+            export ADMIN_PASSWORD="${SplunkAdminPassword}"
+            export STACK_NAME="${AWS::StackName}"
+            export AWS_REGION="${AWS::Region}"
+            export SPLUNK_CLUSTER_SECRET="${SplunkClusterSecret}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export SplunkCMWaitHandle="${SplunkCMWaitHandle}"
+            export REPFACTOR="${SplunkReplicationFactor}"
+            export SEARCHFACTOR="${SplunkSearchFactor}"
+            export S3_USERDATA="https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}scripts/user_data.sh"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export SH_REPLICATION_FACTOR="${SplunkReplicationFactor}"
+            export SMARTSTORE_BUCKET="${SmartStoreBucketName}"
+            export CM_PRIVATEIP="${SplunkCMIP}"
+            export SUBNET1_ID="${PublicSubnet1ID}"
+            export SUBNET2_ID="${PublicSubnet2ID}"
+            export SUBNET3_ID="${PublicSubnet3ID}"
+            export RESOURCE="SplunkIndexerLaunchConfiguration"
+            yum -y install aws-cfn-bootstrap 
+            ## required python modules for ansible to function
+            python3 -m pip install requests pyyaml
+            /opt/aws/bin/cfn-init -v --stack $STACK_NAME --resource $RESOURCE --region $AWS_REGION
+            chmod +x /tmp/user_data.sh
+            /tmp/user_data.sh indexer 
+          - SplunkCMIP: !GetAtt SplunkCM.PrivateIp
   SplunkSHCLoadBalancer:
     Type: AWS::ElasticLoadBalancing::LoadBalancer
     Condition: CreateSHC
@@ -1607,7 +1261,7 @@ Resources:
     CreationPolicy:
       ResourceSignal:
         Count: !Ref 'SplunkIndexerCount'
-        Timeout: PT30M
+        Timeout: PT20M
 Outputs:
   SearchHeadURL:
     Description: Splunk Enterprise - Search Head URL
@@ -1619,20 +1273,19 @@ Outputs:
           - !GetAtt 'SplunkSHCLoadBalancer.DNSName'
           - !GetAtt 'SplunkSearchHeadInstance.PublicIp'
         - :8000
-  ClusterMasterURL:
-    Description: Splunk Enterprise - Cluster Master URL
+  ClusterManagerURL:
+    Description: Splunk Enterprise - Cluster Manager URL
     Value: !Join
       - ''
       - - http://
         - !GetAtt 'SplunkCM.PublicIp'
         - :8000
-  ClusterMasterManagementURL:
-    Description: Splunk Enterprise - Cluster Master Management URL (required for Indexer
-      Discovery)
+  ClusterManagerManagementURL:
+    Description: Splunk Enterprise - Cluster Manager Management URL (required for Indexer Discovery)
     Value: !Join
       - ''
       - - https://
-        - !GetAtt 'SplunkCM.PrivateIp'
+        - !GetAtt SplunkCM.PrivateIp
         - :8089
   DeployerURL:
     Description: Splunk Enterprise - Search Head Cluster Deployer URL