https://community.splunk.com/t5/Monitoring-Splunk/map-command-returns-main-index-even-searching-internal-only/m-p/457791#M6100 <P>This is a known issue SPL-167869 and SPL-169704 which will be fixed on 7.3.</P> <P>Workaround is also available:</P> <P>add following stanza in ../etc/system/local/limits.conf on SH and restart should fix this issue:</P> <PRE><CODE> [search] phased_execution_mode = auto </CODE></PRE> <P>After workaround applied:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7052i4611B062B736438D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 11 May 2019 20:19:53 GMT mchang_splunk 2019-05-11T20:19:53Z https://community.splunk.com/t5/Monitoring-Splunk/map-command-returns-main-index-even-searching-internal-only/m-p/457790#M6099 <P>I tried to test map command on Splunk 7.1.3 with following search:</P> <PRE><CODE>index=_internal earliest=-60m | map maxsearches=1 search="search index=_internal earliest=-6m latest=-1m | head 1" </CODE></PRE> <P>Theoretically, this search should only return one event from index=_internal.<BR /> However, lots of events from main index return</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7053iD5920C6BB59BC248/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Is this a bug?</P> Sat, 11 May 2019 20:12:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/map-command-returns-main-index-even-searching-internal-only/m-p/457790#M6099 mchang_splunk 2019-05-11T20:12:46Z https://community.splunk.com/t5/Monitoring-Splunk/map-command-returns-main-index-even-searching-internal-only/m-p/457791#M6100 <P>This is a known issue SPL-167869 and SPL-169704 which will be fixed on 7.3.</P> <P>Workaround is also available:</P> <P>add following stanza in ../etc/system/local/limits.conf on SH and restart should fix this issue:</P> <PRE><CODE> [search] phased_execution_mode = auto </CODE></PRE> <P>After workaround applied:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7052i4611B062B736438D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 11 May 2019 20:19:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/map-command-returns-main-index-even-searching-internal-only/m-p/457791#M6100 mchang_splunk 2019-05-11T20:19:53Z