Are you sure you're adding the same Splunk version and kvstore version (and engine) instance as the rest of the SHC? ... View more

Thanks for this answer, using it I was able to resolve my issue of finding out the version of all the Enterprise and UFs my team is responsible to upgrade: index="_internal" source="*metrics.log*" group=tcpin_connections hostname IN (<your.servernames>) | stats latest(fwdType) latest(version) latest(os) by hostname   ... View more

Thanks. That helped me resolving my issue, just a small correction that it would be: target="_blank" ... View more

Did you ever get the answer why clients were becoming members of defaultgroup? ... View more