Ok so I'm new to Splunk - got it installed and working via the splunk-7.2.6-c0bf0f679ce9-macosx-10.11-intel.dmg uploaded 3 files to the thing and I'm getting intermittent weirdness -
I often get no results at all - (even when searching over all time)
Some times it works although typically I have to do a re load -
when attempting to run a find a second time Splunk fails.
Is this normal on the mac? Or am I doing something really silly?
In the mean time I might try a linux install
I run on MacOSx and (although I haven't loaded 7.2.6) it's stable. You might check for any messages or errors reported in _internal index.