The Splunk App for Dropbox for Business was installed on our indexer clustering environment and I am getting events. I see no error, but the dashboards do not populate.
Turn's out that the macro.conf is not pushed out via the bundle. Therefore it does not support distributed search. To temporarily fix the issue you need to change the eventtype "dfb_activity" search string dfbindex
to index=dfb and then it will work. I have emailed the publisher to resolve the issue.
Turn's out that the macro.conf is not pushed out via the bundle. Therefore it does not support distributed search. To temporarily fix the issue you need to change the eventtype "dfb_activity" search string dfbindex
to index=dfb and then it will work. I have emailed the publisher to resolve the issue.