Has anyone else experienced events numbered in the 10000 for things such as logins, sharing, etc. for this app? When this happens, it's the same user, for the same event, at the same time.
Are there missing dedup functions that need to be added to the searches?
Can you give an example of a specific search or the dashboard name/panel?
It's most of the searches. As an example, on the Overview dashboard for Total Team Sharing Operations in the last 3 months, I'm getting a count of 825,646. We only have about 8 users in the team.
Could this be a compatibility issue since we're running Splunk 6.3?