This should works if and only if you are managing those saved searches on SHC's GUI not via deployer. Of course you must install those apps 1st with deployer and it installs those on both SHC: You must also understand that those both SHC:s probably use same indexers and then indexers can actually be your bottleneck not SHCs? ... View more

One more comment which is mandatory to know. You cannot manage DS itself with DS functionality! Don't even try it!!! For that reason it's good to use dedicated DS server if/when you have several clients to manage. DS can be a physical or virtual server. It's no mater if there are enough resources for it. Currently you can even make pool of DSs as working like one. If you are Splunk Cloud customer you can order dedicated DS license from Support by creating a service ticket. I have never try if I can do this also as Splunk Enterprise customer too? After 9.2 there are some new configuration options what you must to do in DS especially if/when you are forwarding it's log to centralized indexers. ... View more

1. As @VatsalJagani already pointed out - mongodb is an integral part of Splunk distribution and Splunk relies on it to work properly. Therefore changing its configuration is not recommended and you're very likely to cause problems if you're changing things without deep understanding of their impact for the whole environment. 2. Baseline checks, vulnerability scans and such are just tools to help you assess the state of the system, not do the job for you. They alone are not sufficient grounds for telling you what is OK and what is not. Running them blindly and following their "recommendations" without understanding the results of performed tests and their context is not a good practice. ... View more

they are probably talking about this   https://www.sentinelone.com/partners/featured-partner-splunk , but it that resource and what it links to haven't answered my questions about getting the SentinelOne Splunk app working    ... View more

Thanks @Dallastek1  Did you use just this app in Cloud or also another app (IA, TA add-ons) on Heavy Forwarder?   ... View more