I suspect that your "synchronization" is broken. What do you mean by that? The files that you show are basic configuration files that your splunk instance needs. In particular the files in the /opt/splunk/etc/system/default directory are important and should not be changed. If you are attempting to replicate changes between Splunk instances, you should leave the default directories alone. As for how to recover, you could restore them from a backup if you have one. Or you could reinstall Splunk. Depending on how badly the synchronization has damaged your Splunk instances, reinstallation might be the best route to a stable and correct Splunk. ... View more

"click here to sync" does not work for me 😞 I cant sync email even if I change it in splunk.com ... View more