Why are the dashboards in the Splunk App for Dropbox for Business not being populated with data in our indexer clustering environment?

[haliakbar_splun]

The Splunk App for Dropbox for Business was installed on our indexer clustering environment and I am getting events. I see no error, but the dashboards do not populate.

[haliakbar_splun · Accepted solution]

Turn's out that the macro.conf is not pushed out via the bundle. Therefore it does not support distributed search. To temporarily fix the issue you need to change the eventtype "dfb_activity" search string dfbindex to index=dfb and then it will work. I have emailed the publisher to resolve the issue.