Sounds like there is an EBS, but maybe something went wrong, didn't attach, and so the Splunk installation defaulted to the ephemeral storage ... which can happen! Maybe try again? ... View more

I have multiple Splunk instances, but not in this case. Here, I'm only thinking of piggy-backing this particular instance on the data input used by one of the others I have running. ... View more

Splunkd is serving up an in-memory copy of the xml view, which is why you are not seeing your file system updates via the UI. In order to do so, you will need to reload these files from disk. There are several ways to do this. Restart splunk Trigger a refresh from splunkweb (go to http://splunk_host:splunk_port/debug/refresh). This will reload all assets ... View more

Where is your "previously posted" link? What have you edited? Where did you put the edited files? Because you have not provided any details, I will have to guess. Assuming you have updated views inside an app, if you placed them in default , you need to make sure an old copy of the same file is not inside local because then it will have precedence and the other one will be ignored. You also need to make sure that this file is copied to the Search Head (or deployed to it from your DS). You should not need to restart Splunk for changes to take effect (but you will have to refresh your browser if you are on that dashboard). ... View more

Maybe here? ... View more

Ya'll try 6.2.4 yet ? ... View more