Would you be able to share a sanitized version of your deploymentclient.conf? ... View more

Hello,   Please see the below link: https://dev.splunk.com/developer-program/ You will need to join the Splunk developer program and then there is a link on your dashboard that lets you request a license.  Licenses, once approved, are sent to your email address.   The license process usually takes 1-3 days in my experience.  You’ll need to renew once every 6 months. Hope that Helps! ... View more

Splunk internal logs are generally in $SPLUNK_HOME/var/log/splunk/ ... View more

Here are a few links that you could use to get started: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/custominputs/modinputsoverview/ https://help.splunk.com/en/splunk-enterprise/developing-views-and-apps-for-splunk-web/9.4/modular-inputs/create-modular-inputs https://docs.splunk.com/Documentation/AddonBuilder/latest/UserGuide/Overview?_gl=1*8rd2c7*_gcl_au*MTk4OTAxOTc4NS4xNzU4MTM1MjA0*FPAU*MTk4OTAxOTc4NS4xNzU4MTM1MjA0*_ga*NTUzNjExMjI1LjE3NTgxMzUyMDc.*_ga_5EPM2P39FV*czE3NTgxMzUyMDYkbzEkZzEkdDE3NTgxMzg2NjQkajYwJGwwJGg1NjYwNTAyMjg.*_fplc*R3hBUWZ0b2J6aTNpVlVVN3R4eEIySU1Ic0slMkJwdmNpbkUlMkJwYlNoSmpuMFpnWjIwQ0lOemduanNrVUZjYzNmczNIWlJoNklKcUR4dFhxTGlhTzBhQW9zWFZ3JTJGamk2T1ZSSHMlMkZiJTJGOGxUSG4lMkZNZHcySCUyQiUyRnNLTWZ5RlRRZFFqUSUzRCUzRA.. Hope this helps, and good luck!   ... View more

Does this help? https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/assetcaching/ There are other places to turn off caching to speed things up.  Not a good idea on a production server, but just find for development. ... View more

Although it probably doesn't explain the intermittent nature of the problem, I've seen fapolicyd interfere with some Splunk Add-On UI pages.  If this were the case you would need to configure an fapolicyd exception.  You can audit fapolicyd using the command: sudo /usr/sbin/fapolicyd --debug-deny Hope this helps! ... View more