our main Splunk administrator retired and we since disabled his Active Directory account which he used to create and manage hundreds of Splunk searches, now listed as Orphaned under Settings \ All Configurations \ Reassign Knowledge Objects \ Orphaned we have the option of reassigning these searches to other Domain Accounts belonging to regular Splunk non admin users, or to the built in default Splunk admin account which is a local account on the box with no Domain permissions, so the question is should we do that since there is also this Warning: Knowledge object ownership changes can have side effects such as giving saved searches access to previously inaccessible data or making previously available knowledge objects unavailable. Review your knowledge objects before you reassign them. Running Splunk version 9.0.0 on the Microsoft Windows platform  ... View more

not sure what it looks like on the Unix platform but in the Web UI on a Windows Server there is no separate square aka pane for the Deployer Server as in the Search Head Cluster software configuration Deployer on the Overview screen, although it is clearly assigned the Deployer role in the Monitoring Console and that is the only role for that Instance (I like to follow the guidelines to the T)  When you click on Topology it shows up under the Other category along with the Cluster Master and Deployment servers  All I'm saying is that it would be nice to be able to see it's performance metrics  on the Overview page along with all its other brother and sister servers  ... View more

on version 9.0.0 when you go to Manage Apps in the web UI and then click on the Name column arrow to sort your apps by name it just doesn't sort them correctly, have any of you noticed that?  ... View more

On a Windows Server when I go to Settings \ Monitoring Console and launch it, there is a Menu item called: Forwarders: Instance which appears not to be configured and when I try to run setup I get this warning about it effecting performance, so my question is, are any of you running this feature? Forwarder Monitoring Setup Forwarder monitoring dashboards provide information on forwarder activity and throughput. If you turn on forwarder monitoring, Splunk Enterprise enables a scheduled search named "DMC Forwarder - Build Asset Table"  that relies on internal network input metrics that your indexers record. If you have many forwarders, this search can significantly affect the search workload of the indexers. To mitigate the cost of this search, increase the data collection interval so that the search runs less frequently. Learn More  Forwarders: Instance Forwarder Monitoring is disabled. Please go to the setup page to enable it.     ... View more

I see that in our environment some of our Search Heads are setup as forwarders and some are not, I think this environment like most grew from one server to a multiple server environment all before my time Now we have Search Heads and dedicated Deployment servers aka Forwarders which leads me to believe we no loner need the Search Heads to forward anything, so is there a way I can see what is using the Search Heads as forwarders? ... View more

after Splunk version upgrade (some time ago, I'm sure) there is a new directory on the Index Cluster Master called manager-apps but the old one called master-apps is still there as well  I know why Splunk did this, the question is how are things handled moving forward? all of my old apps are still under master-apps, does this mean they will stay there and if I create any new cluster apps I need to create them under manager-apps now? In other words it appears Splunk did not just rename the old directory or move the apps to the new one automagically? ... View more