The tSessions_Lookup_Update report from the splunk_app_windows_infrastructure is the main or only report for which we see many skipped searches.
The code is -
| eval _key = session_id
| sort 0 _time
| outputlookup tSessions append=true
| inputlookup tSessions is not even responsive.
| inputlookup tSessions
What can it be?
Looking via the MC at search->kvstore->instance and we see -
We see 268,809,800 objects for this collection. Does it make sense to have so many objects? Should we maybe initialize this collection?