I think the simple answer is to upgrade your indexers. Upgrading the indexers from 6.2.2 to 6.2.3 wouldn't take a long time nor is it risky. As you're probably aware, best practice is to upgrade indexers before search heads. If you have some dire business requirement not to upgrade the indexers then it would be best to open a support ticket to raise the issue with the folks that would know why 6.2.3 is specifically required for ES 3.3. ... View more

it is a separate license. You should definitely contact Sales with your questions! ... View more

Thank you, that did the trick! I opted to add the stanza to (/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf) add (companyname_TA_.*) I went with this option because we add the company name in front of each modified TA and this method will catch all of them. [app_imports_update://update_es] disabled = 0 app_regex = (TA-.)|(Splunk_TA_.)|(companyname_TA_.)|(sideview_utils)|(SplunkEnterpriseSecuritySuite)|(DA-.)|(SA-.*) Save changes Go to Manager > Apps > Enterprise Security > Setup. Click OK. Restart Splunk ... View more