Hi mate. It's the same issue. The whole app gets removed from all SHC members. It's a hack indeed, but only solution since the app got removed and there is no way to put it back without changing the hash. Indeed. It's a bug... ... View more

Just delete following line: '/opt/ee_splunk/splunk/etc/apps/splunk_essentials_8_2/default/app.conf From the splunk manifest in /opt/ee_splunk/splunk Sometimes Apps created during the installation ( The ones that splunk keeps a manifest), if they get pushed by the SHC deployer,  the checksum can get modified when the members get it. I had the same issue with this App and the only way I could get it working was by deleting the record... The App booked a one way flight to Belize when I created the Search Head Cluster.  ... View more

As long as you don't change the sourcetype=stash. If you send to a different sourcetype it will count toward your license usage. ... View more

Wrong! If you overwrite the original sourcetype created by "|collect " (stash) it will count towards your licence. ... View more

I down voted because he said to use KV_MODE = json during index time. Can you really use KV_MODE = json during index time????? ... View more

I downvoted this post because kv_mode is used for search-time field extractions only ... View more

I downvoted this post because really? ... View more

No. There is no inputs.conf ... View more

none for sideview utils ... View more