@ab374134  Did you try enabling the input "vmstat.sh" of the add-on? This input leverages the same command that you want to get the required information from. Hope this helps. ... View more

A deployer can only be shared between multiple SH clusters if the clusters have the exact same apps and configurations and use the same secret. See also: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Deploy_to_multiple_clusters So no, you cannot use a single deployer to manage the configuration of such 3 very different search head clusters. Also a Deployer cannot be used to manage an Indexer Cluster. You use a Cluster Master (also known as Master Node) for that. ... View more

You can adjust this on any of the search heads with in the cluster it will populate to all so that the disabled components are completely disabled. This component uses the same rest calls as disabling a search. ... View more

Check out this post https://answers.splunk.com/answers/154862/how-to-hide-or-grey-out-clone-option-under-edit-on-splunk-dashboard.html please accept answer if it helped. Thx ... View more

So your base search has all required arguments for a servicenow ticket? ... View more