I too am having the same problem. The fortigate apps are installed and are ingesting if I search with index="*" sourcetype=fgt_logs but none of the dashboards provided by the app show anything. There has to be some type of transform or data source not configured right. ... View more

I know this is an old thread but I've been trying to figure this out as well on Splunk Enterprise 7. These settings do not seem to work. I even tried the custom folder MY_user_settings. The btool output shows the settings are configured. Seems like Splunk would have a simple setting like the 'userTour' option to not show the help improve modal. ... View more

That info is pulled from metadata (see the metadata command) and is based on the default searched indexes for the user that loads the page. You can adjust this via the user's roles and group memberships here : Manager » Access controls » Roles » Role Name » Default indexes. Update that for the indexes, or add all etc... ... View more