@dataisbeautiful  You should be able to control this by adding this line: display.visualizations.charting.chart = line to the following .conf file(s): Global: $SPLUNK_HOME/etc/system/local/ui-prefs.conf Per User: $SPLUNK_HOME/etc/users/<username>/system/local/ui-prefs.conf For more information see: https://docs.splunk.com/Documentation/Splunk/9.3.1/admin/Ui-prefsconf ... View more

We fixed this issue by changing the HEC endpoint that the data was being sent to from services/collector/raw to  services/collector/event. More information here: https://docs.splunk.com/Documentation/Splunk/latest/Data/HECRESTendpoints ... View more

@Dave2d   Did you ever find a resolution for this issue?  Thanks! ... View more

Updated link: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamanagernodegoesdown ... View more

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder. mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/   ... View more