@hifimarko, It could be due to the configuration file precedence. Your configuration files in the app might be overriden by a local directory parameter. Use btool to list and see the configuration sources Precedence order within global context: When the context is global (that is, where there's no app/user context), directory priority descends in this order: System local directory -- highest priority App local directories App default directories System default directory -- lowest priority Precedence order within app or user context When there's an app/user context, directory priority descends from user to app to system: User directories for current user -- highest priority App directories for currently running app (local, followed by default) App directories for all other apps (local, followed by default) -- for exported settings only System directories (local, followed by default) -- lowest priority Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Wheretofindtheconfigurationfiles ... View more