We are trying to use the CEF App, to create a new Output App to be deployed to our two indexers. However during the "Define Output Groups" step of the "New CEF Output" wizard, the green "Create output group" button referenced in the documentation, is missing.
We are running
Splunk Enterprise
Version: 7.3.0
Build:657388c7a488
After a bit of troubleshooting where we first thought the issue was with missing role permissions in Splunk, it turned out the KV Store was not running due to an expired certificate. We recreated the certificate using the splunk createssl
command, restarted and voila, the Create Output Group button reappeared.