Splunk Stream Built-in stream populating Dashboard vs Protocol Events

[support0]

Hi there,

I have deployed Splunk Stream on a distributed environment.

SH ES > Stream App + Stream TA
IDX > Stream TA
Win UF > Stream TA + imputs config received from SH ES

It worked with DNS data so I did not pay much attention to it, but then I realized I could only pull data from Streams entitled "Built-in stream populating XXX Dashboard".

The ones named XXX Protocol Events, I am not able to pull data from it.

Anyone knows the difference between Built-in stream populating XXX Dashboard & XXX Protocol Events stream.

What could be the cause for having one kind working and not the other one ?

I have tried to investigate _internal data without luck so far.

Thanks in advance for any advice,

[support0]

I had completely missed the "Configured Streams" part, thanks!!

[vshcherbakov_sp · Accepted solution]

Hello @support0,

Only streams populating the dashboards are enabled out of the box when you install Stream. You need to enable other streams and make sure they're properly assigned to the forwarder groups using the Splunk App for Stream config UI.