This is confirmed in the latest docs https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.3/deploy-search-head-clustering/system-requirements-and-other-deployment-considerations-for-search-head-clusters#maximum-number-of-instances-0 ... View more

I assume you meant the path to be $SPLUNK_HOME/etc/apps//local/data/ui/html ... View more

It sounds like you don't have a field extraction set up for bldg. The following documentation will explain why, a lot better than I can. http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/WhenSplunkEnterpriseaddsfields http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Indextimeversussearchtime Default field extractions have to be common to every entry. By identifying the different sourcetype and index, is making the bldg field common to all entries. Then you're performing another search where your string would match. I could be wrong, but I am going to guess there is an entry where bldg has a value with a space in it? ... View more

In our case: Our directory $SPLUNK_HOME/var was located on another partition than $SPLUNK_HOME/etc and was referenced by a symlink. Splunk was not able to move the bundle directory from one partition to another (/opt/splunk/var/run/splunk/cluster/remote-bundle/72329e457bf34d9351eb50a4dec40a85-1377020099/apps/_cluster to /opt/splunk/etc/slave-apps/_cluster). Splunk considered this behaviour as a bug in 5.0.4 and planned to fix it. ... View more

This may be related to this: http://answers.splunk.com/answers/208585/why-am-i-getting-an-error-and-failed-replication-c.html ... View more