Why don't the dashboards in the Splunk App for Stream get populated with data?

[jbrodsky_splunk]

Why don't the default dashboards in the Splunk App for Stream get populated with data? Why can't I assign a forwarder to a group within the Distributed Management capability in the Stream app?

[jbrodsky_splunk · Accepted solution]

You may notice that the Splunk App for Stream has a number of dashboards to allow you to monitor your Stream environment. Also, in version 6.3 we added the "distributed forwarder management" feature that allows different Stream forwarders to monitor different protocols.

In order for these two features to work, your remote Universal Forwarders (UF) must have a modification to their outputs.conf, so that they can write directly to the _internal index with your Splunk environment. This is actually documented here:

http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/Deploymentrequirements#Splunk_c...

When you do this, the stream:stats sourcetype will populate data into _internal, and these two features will work.