I believe the maintenance release 8.1.0.1 might fix this, per the release notes: https://docs.splunk.com/Documentation/Splunk/8.1.0/ReleaseNotes/Fixedissues 2020-10-27 SPL-196757, SPL-197069, SPL-197599 Upgrading Cluster Master to 8.1 with indexer discovery enabled stops CM forwarding its logs ... View more

I'm seeing this error on my cluster masters since upgrading to 8.1.0 Would love to see a fix! ... View more

I really hope someone answers this question. The add-on hasn't been updated in many years, and this lack of synchronization options is really hampering the data validity.  ... View more

You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information. Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server. ref: https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.14/PhantomRemoteSearch/Connecttodistributedsplunk ... View more