Splunk Admin Considerations

General

• The KV Store must be enabled for this app to work, core functionality relies on the KV store

Dependencies

• App is deployed with jQuery UI - v1.12.1 - 2019-12-05

Indexing

• By Default, item events are not indexed unless explicitly enabled (enable=true)
• By Default, the app is not deployed with an indexes.conf file and will not create any indexes

Dependencies

• Item event indexing must be enabled to use some reports.
  • Item(s) Removed - Last 7 Days