It's probably better to modify it in $SPLUNK_HOME/etc/system/local/web.conf and add [settings] docsCheckerBaseURL = https://some.example.com/foo If I'm not mistaken, the var/run/splunk/merged directory contains cache files produced by btool. ... View more

You could download Sideview Utils 2.0, which has a new module called SearchControls. In appearance it looks like the JobStatus module, and you can give your users the ability to pause, play, cancel, finalize the job, or to save searches or alerts, or to create dashboards etc... However it also has an export button, and unlike both JobStatus and ResultsActionButtons, you can configure it to only display the options that you want available. So for instance you can strip it all the way down to just export, by doing: <module name="SearchControls"> <param name="sections">export</param> </module> or you can give it the ability to export, print save searches, save results, but not the "save and share results" options: <module name="SearchControls"> <param name="sections">export print saveMenu</param> <param name="saveMenu">saveSearch saveResults</param> </module> I too was bitten by the disappearance of export from ResultsActionButtons, and for a while I replaced them all with heavily-patched JobStatus modules. But this was really clunky, and of course there was no 'export', so after a while I went back and implemented the SearchControls module. ... View more

Hi Lu, You know, a primary objective is to hide these failures and to do that we need a solid architecture in which the peer nodes back each other. Due to solid growth, our cluster is not stable, but because of six indexers, Search Factor and Replication Factor at three and the net result is that to the outside world we are very stable. Cheers ... View more