Hello, I have some issues regarding changing the configuration of Splunk Enterprise Security. My system consists of 5 search heads and all apps and add-ons are pushed from the Deployer in the default push mode (merge_to_default), including Splunk ES. The issue is that I previously configured the alert email in ES Content Update on the Search Head via the Web GUI, and this configuration would then be replicated to members in the cluster. Now I want to add another email to this section, but changing each rule manually is too time-consuming, so I directly edited the savedsearch.conf file, but it did not replicated to the remaining members. After reading Splunk's documentation, I have an idea that I can change the push mode to local_only for the Splunk ES app, so that the savedsearch.conf file that was configured in: $SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/local/savedsearchs.conf Then push the bundle down to the captain, and the configuration will then be replicated to the remaining members in the cluster. Is this plan feasible and are there any potential risks that could occur when following this approach? ... View more

Hi everyone, I'm having some trouble and really need your help. Currently, I'm deploying ITSI Splunk service and using Add-on for Unix and Linux on Splunk. The problem is that when I send data to ITSI, ITSI didn't receive any Entity        Down here is my configuration on Add-on for Unix and Linux :        Also, my Splunk Enterprise has collected Linux log by Universal Forwarder . I don't know what is the problem with my ITSI. Please help me. ... View more