Hello Splunkers! We are at the end of migrating an old deployment, to a new one(C1). So far everything checks out, except Datamodel summaries for Unique user roles, they are not visible when you run summariesonly=true(summariesonly=false obviously works) for all datamodels, in every unique Role. So far , we have checked: -Datamodel permissions, they are set to Read Everyone, shared in app(Tested in Global as well). -Role capabilities and indexes that the datamodel is built on(Index access is granted to the roles, as well as necessary capabilities->Accelerate search, accelerate datamodel) -Rebuilding the datamodel. Only thing that provides a fix, is giving those users, admin roles, which is not an option, considering RBAC strats. Any tips , ideas? Thank you!   ... View more

Hello! We have a Splunk Cloud, for which we set up two on-prem components: -Heavy forwarder( To route all file based logs through it as an intermediate forwarder to Splunk Cloud) -Deployment server( To configure UF's)   We have downloaded the uf credential package, and set it up as an app, which we pushed it down to the heavy forwarder, to test if _internal logs appear, which they do, but I do not see the HF listed as a client on my Forwarder management page anymore. Here comes the tricky part( if i delete a serverclass, the _internal logs disappear, so it still communicates, and i can see the deployment server listed if i push the command from HF: splunk show deploy-poll, but see nothing on DS if i push:  splunk list deploy-clients On the HF, deploymentclient.conf is configured correctly. Any ideas? Thanks! ... View more

Hi Guys, We are about to expand an Indexing Cluster from 2 to 3 with an additional Index peer. The process is pretty clear. Up until the point, where I have to migrate/clone or fill out the server.conf or web.conf files along with the splunk secret.   The other two Indexer servers, upon inspecting the files, have different pem,key and crt files. I thought these have to be identical? Do i need to generate a third one, that is different as well, or sync all 3 so that they are identical. Any guidance is appreciated ! Thank you   ... View more