This is a known issue reported in this version, please verify the following information: SPL-208259, SPL-210931, SPL-211811 https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/KnownIssues Workaround: Copy splunk_essentials_8_2 into the deployer's $SPLUNK_HOME/etc/shcluster/apps. ... View more

I downvoted this post because really? ... View more

disregard; I just saw @jmeyers_splunk comment below ... View more

As long as you don't change the sourcetype=stash. If you send to a different sourcetype it will count toward your license usage. ... View more

Can Splunk please clarify? Is it true that, if sourcetype is changed to anything other than "stash", summary indexed data would count against license usage? ... View more