Would you share the savedsearches.conf using btool?
$SPLUNK_HOME/bin/splunk btool savedsearches list
And send us the stanza for your dashboard PDF. It could be named something like _ScheduledView__<dashboardId>
... View more
@vladislavplaksy - I'm checking to see if anything is available for documentation.
Meanwhile, Administer Splunk App for Infrastructure's Advanced Data Collection may be of use because it taught me that Collectd captures the metrics and then plugin_http or write_splunk can be used simply to direct that output to the HEC. I don't know much about hadoop but if you can write the metrics to a log or to http event collector then you should be all set.
... View more