I did a complete re-deployment of this onto a new VM and had the same issues with a vanilla install, no changes to summary index retention. I Did see our summary indexes fill with data which took a long time due to the size of our environment. But search performance for all the standard dashboard reports took hours to complete and show all the results.
In the end I've had to roll back to Dep Mon 4.3.5 which does work correctly.
I've raised a ticket with Splunk so hopefully it's fixed in next release, as it appears unable to handle large deployments right now.
... View more