Had the same problem and solved it following aelliott's suggestion. I made time ago a copy of the search app but with another name. then there was another "default/data/ui/manager" dir in the copied app. Just deleted that dir and Splunk 6 worked fine! No more duplicates!!! Check if under $SPLUNK_HOME/etc/apps/* you have another "manager" dir somewhere. Marco ... View more

Based on that I'm guessing you're not using AdvancedXML dashboards, so that approach isn't going to work for you. ... View more

Perfect, thanks. ... View more

have a look at this answer http://splunk-base.splunk.com/answers/78921/splunkd-using-too-much-ram and keep analyzing what splunkd is using swap ... View more

Np, glad it helped! 🙂 ... View more

To accomplish this the second host in the chain needs to be a full version of splunk, not a Universal Forwarder. This is because the intermediary will be acting as an indexer to collect any data forwarded to it. So on your application server, in it's Universal forwarder instance, you will want an outputs.conf with something like: [tcpout] server=logforwarder Then, on the logforwarder machine, you will have a full splunk install, but it will also have a outputs.conf indicating where it should send it's data to: [tcpout] server=webpanel logforwarder does not need an inputs.conf, as it's not monitoring any logs directly. It's simply accepting incoming data much like an indexer would. You would also want to have any other props.conf stanzas present that are relevant at index-time. (line breaking, timestamps, etc) ... View more