not sure what it looks like on the Unix platform but in the Web UI on a Windows Server there is no separate square aka pane for the Deployer Server as in the Search Head Cluster software configuration Deployer on the Overview screen, although it is clearly assigned the Deployer role in the Monitoring Console and that is the only role for that Instance (I like to follow the guidelines to the T)  When you click on Topology it shows up under the Other category along with the Cluster Master and Deployment servers  All I'm saying is that it would be nice to be able to see it's performance metrics  on the Overview page along with all its other brother and sister servers  ... View more

on version 9.0.0 when you go to Manage Apps in the web UI and then click on the Name column arrow to sort your apps by name it just doesn't sort them correctly, have any of you noticed that?  ... View more

On a Windows Server when I go to Settings \ Monitoring Console and launch it, there is a Menu item called: Forwarders: Instance which appears not to be configured and when I try to run setup I get this warning about it effecting performance, so my question is, are any of you running this feature? Forwarder Monitoring Setup Forwarder monitoring dashboards provide information on forwarder activity and throughput. If you turn on forwarder monitoring, Splunk Enterprise enables a scheduled search named "DMC Forwarder - Build Asset Table"  that relies on internal network input metrics that your indexers record. If you have many forwarders, this search can significantly affect the search workload of the indexers. To mitigate the cost of this search, increase the data collection interval so that the search runs less frequently. Learn More  Forwarders: Instance Forwarder Monitoring is disabled. Please go to the setup page to enable it.     ... View more

I see that in our environment some of our Search Heads are setup as forwarders and some are not, I think this environment like most grew from one server to a multiple server environment all before my time Now we have Search Heads and dedicated Deployment servers aka Forwarders which leads me to believe we no loner need the Search Heads to forward anything, so is there a way I can see what is using the Search Heads as forwarders? ... View more

after Splunk version upgrade (some time ago, I'm sure) there is a new directory on the Index Cluster Master called manager-apps but the old one called master-apps is still there as well  I know why Splunk did this, the question is how are things handled moving forward? all of my old apps are still under master-apps, does this mean they will stay there and if I create any new cluster apps I need to create them under manager-apps now? In other words it appears Splunk did not just rename the old directory or move the apps to the new one automagically? ... View more

hi I am fairly new to Splunk and inherited an environment and would like to know why some of our Dashboards source code starts with the <dashboard> tag where others don't have that tag and start with the <form> tag furthermore if I add the <dashboard> tag above the <form> tag (of course terminate it at the end of the code as well with </dashboard>) I get the following Alerts / error: This dashboard has no panels. Start editing to add panels. ... View more