I think I know what the issue may have been, or at least in my case this was this issue: The DBX connector is installed on a heavy forwarder, and the reason the index box is outlined in red is because the index doesn't exist on the heavy forwarder, but the index is valid on the cluster. Setting it to 'main' then modifying the inputs.conf manually worked for me. Splunk 6.3.0. Splunk DBX 2.0.5. Sun Java 8.0_60 Cheers ... View more