Guys, I would like one. yours.
He has little experience with Splunk and many doubts.
Here at my job, I need to configure the Linux Audit app.
The query that comes ready from the APP is showing three errors when performing the search.
You can help me fix this problem.
| tstats count WHERE [|inputlookup auditd_indices] [|inputlookup auditd_sourcetypes] BY _time span=1h | predict count as prediction future_timespan=0 algorithm=LLP | rename lower95(prediction) as lower, upper95(prediction) as upper | eval range=upper-lower | eval difference=case(count>lower AND countupper, round((count-upper)/range,1)) | search difference=* | table _time difference
Dispatch Command: Unknown error for indexer: brlxp*******. Search Results might be incomplete! If this occurs frequently, please check on the peer.
command="predict", No data
Unknown sid.
