Neither of these solutions solved my problem, however this link showed that I should put the multisite = false in the clustermaster:somesite stanza https://docs.splunk.com/Documentation/Splunk/7.2.5/Indexer/Configuremulti-clustersearch ... View more