I am doing a fresh install of the Slack notification add-on to our on-prem enterprise Splunk. It requires Slack Webhook Alert. Are there substantial differences between Slack Webhook Alert and Slack Webhook Alert v3? Should I simply install v3 because it is newer and I am not doing an update/install? tia, ray ... View more

Hi, This is a very nice dashboard. One comment, I notice that the 'Host Usage - Current Day - Top 20' panels are displaying the indexer name as the 'host' field. I suspect you want to use the 'h' field which is the name of the forwarding agent. At least that is where I find the most value. So the search text would become "index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by h | eval "Bytes"=round(b) | rename h as Host | fields Host, "Bytes" | sort 20 - Bytes" Warm Regards, ray ... View more