I had this same problem so I thought I would share. For me, I was dealing with a clustered Environment. I went and looked at Splunkd.log and saw a bunch of messages like network unreachable and could not connect to peer etc.  Turned out Splunkd was down.  Restarted Splunkd on the CM and it reconnected. Hope that helps someone in the future. ... View more

I see you got no response to your question. Were you able to resolve the issue? And how did you go about it? I'm dealing with a similar situation. Thanks. ... View more

Option 2 gives you a bit more flexibility if you want to see both matched and not matched records (e.g, filter on the field "matched" and "index_list") ... View more

This worked, as well! 🙂  Thank you! I sincerely appreciate your help.  ... View more

It ends up that in the local/savedsearches.conf you have to also add disabled=1 also ... View more

Hi @KayBeesKnees83, you can install now both the licenses, you don't need to wait the the first one will expire. Ciao and happy splunking. Giuseppe ... View more

You should use that version which you are normally using. That means rpm for red hat based, dep for Debian based or tgz for all Linux, if you are not preferring the use of package manager.  If you needs some additional data management on client side then you need HF (full enterprise). That means using e.g. transforms.conf or python are needed. As I earlier said, I prefer to use same license manager for those than to another nodes. To define that it’s a HF, just configure that it forward everything to indexers. In all other cases you should install UF to source systems. r. Ismo ... View more

All of that is well documented at docs.splunk.com ... View more