Running Splunk 8.2 I have discovered that after completing a dashboard within Dashboard Studio, bundling it up to move from Splunk instance to another, the background (png/jpeg) that was attached to the original dashboard is missing.  In the source code it does reference a KV store hash. The KV store has been "upgraded/updated" from the original environment that the dashboard was designed on to the current Splunk environment that the background seems to be missing. Possible solution would be to save the png within the app, however, I can't upload or reference that image in the app via the GUI given the Splunk host-separated environment (Search Head, Master, etc all are different virtual hosts and are not hosts I can simply click "browse" for within dashboard studio as that references the local box which isn't part of the Splunk environment).  And there doesn't seem to be good logic on how to change the source code to identify the png within the App.  I've seen other Splunk questions and the response right now is it's a possible "bug." Is there anyone trying to do something similar that has an effective work around?  ... View more

I have installed a Splunk Forwarder version 8.0.4 on a rhel machine. After a successful install, which I am getting logs for now. I cannot run locally, on the target Universal Forwarder, commands like "Splunk list monitor", "Splunk list forward-server",  "Splunk list deploy-poll", etc. For whatever reason I does not allow me to run these commands while the forwarder is on. However, if I turn the forwarder off (Splunk Stop) then I can run all of these commands without hanging. Obviously if you run a "ps -ef  | grep splunk " I find splunk processes. Often times I'll see a splunk start process or a splunk restart process in there. I believe that the process is hanging on that (not sure). But when I kill those processes it auto stops splunk and I can then run the commands (with it now off) and I can get the info I need. I have installed SPF many times and have never encountered this. Thoughts? ... View more