"Multiple FMCs can connect to this version. " No - that's a bit misleading @douglashurd - The app supports one FMC. You require multiple versions of the app, however this does not work because the app cannot be renamed without breaking it due to absolute paths being used in many places within the app. You need one heavy forwarder host per FMC which is madness as other log collection methods support hundreds or even thousands of hosts for each heavy forwarder depending on specification. Even if you have multiple heavy forwarders deployment via a central repository such as GIT is challenging as the apps have the same name, which may force a re-engineering of the deployment methods. Really needs to support multiple FMC's in the same app. Better yet - just sent the same events over syslog and bury the eStreamer protocol.... Not enterprise ready 😞 ... View more

have you tried keeporphans=true, this should display all other results alongside any groupings? ... View more

I've experienced this same issue after installing the latest patches in Ubuntu 17:10. Splunk now fails to start on any VM (both enterprise and universal forwarders) with the same error code. Not had time to investigate yet but i suspect its a doggy patch, possibly for the recent meltdown/spectre issues. ... View more