I am trying to setup Splunk Security Essentials in a distributed environment on a SHC. I've installed v3.3.2 and all the app was successfully deployed to our search heads however I am having an issue with populating the data inventory. Periodically when we try and enter SPL in for a specific data source and refresh the page the data in input prior will simply disappear. While I see to be able to get around this by adding the input then staying on the page for an extended period in time, all of my data sources that I've added are stuck on the "Analyzing CIM and Event Size" status. I am testing on data sources which have the proper TA's installed for CIM parsing (ex. windows events), but none of my sources are able to get past this stage. Has anyone ever encountered this before or have any suggestions? I don't see any errors in the internal logs coming from the app.
