Ran into this same problem today.  The short version is that the deployer's server.conf file needs a value for "pass4SymmKey" value in the [shclustering] stanza in order for the E.S. setup to detect that a Splunk instance is a Search Deployer (even though technically a Deployer doesn't seem to actually need this value explicitly set). If you care for more technical detail: Tracing backwards, you probably saw something like this in the logs: 2022-04-04 21:44:51,916+0000 INFO pid=85111 tid=MainThread file=ess_configured_handler.py:handle_ssl:230 | Standalone SH detected Digging into /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/ess_configured_handler.py, you find the code: def is_shc_deployer(session_key):     '''     Determine whether we are on a SHC deployer     '''     unused_r, c = rest.simpleRequest(         'configs/conf-server/shclustering',  # noqa: X101         sessionKey=session_key,         getargs={'output_mode': 'json'},         raiseAllErrors=True     )    c = json.loads(c)['entry'][0]['content']     if c.get('pass4SymmKey'):         return True     return False ... so your server.conf file should have: [shclustering] pass4SymmKey=xxx ... in order for the auto-detection to work the way you'd expect in E.S. ... View more

Officially, the answer is to just ignore the error and/or upgrade to a patched version. Unofficially, you could update the manifest yourself. To clear this error, you’ll have to update the manifest file (name varies depending on splunk version) at: /opt/splunk/splunk-7.3.2-c60db69f8e32-linux-2.6-x86_64-manifest You’ll want to back up the manifest, then update the line with datetime.xml with the latest sha256 hash. If you make the changes exactly as prescribed in the article, adding just the four characters specified, your new file’s hash will look like this: f 444 splunk splunk splunk/etc/datetime.xml f2901c888ad87ac54f6d8274cdb1ec26edb5e802f71dd72a9ffa384a935692f6 But, if you want to be sure, you should be able to run sha256sum to view the hash after you update your file: ...$ sha256sum /opt/splunk/etc/datetime.xml f2901c888ad87ac54f6d8274cdb1ec26edb5e802f71dd72a9ffa384a935692f6 /opt/splunk/etc/datetime.xml After restarting Splunk, Splunk will validate the file and since the hash in the manifest will match the hash of the file on-disk, the error will disappear. ... View more

Check out: https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes/Fieldaliasbehaviorchange. The behavior of Field Aliases have changed in 7.2 and 7.3 over previous versions. That article does a good job of explaining how and why. You probably want to use coalesce or the new AS NEW keyword. ... View more

We saw the same problem until we upgraded to the latest version of the app, which handles large data sets better. Are you on the latest rev? ... View more