I wasn't able to get this to work directly to a network folder as you posted. If you are still working on it, I ended up configuring a folder on each indexer that is a NTFS junction to a remote file share. This way, the splunk service writes as if it is a local file and NTFS takes care of the rest. I'm not sure if it's a supported solution, but my low-volume cluster has been running like this for several years with no apparent issues. One thing to note with an indexer cluster is to point the junction to a different folder within the share for each machine to avoid naming collisions (IndexerA's junction should point to \server\share\indexerA and IndexerB's to \server\share\indexerB or some similar scheme). ... View more

I was able to get my DMC working correctly by using the Reset All Settings button in the DMC > Settings > General Settings menu. This did reset everything else in DMC but it's working properly now. ... View more