The tSessions_Lookup_Update
report from the splunk_app_windows_infrastructure
is the main or only report for which we see many skipped searches.
The code is -
`tsessions`
| eval _key = session_id
| sort 0 _time
| outputlookup tSessions append=true
| inputlookup tSessions
is not even responsive.
What can it be?
Looking via the MC at search->kvstore->instance
and we see -
We see 268,809,800 objects for this collection. Does it make sense to have so many objects? Should we maybe initialize this collection?
You may need to add the index, especially if running the SPL as Splunk admin. Else will look through all available Splunk indexes. The actual saved search for tSessions_Lookup_Update in https://splunkbase.splunk.com/app/1680/ (Splunk App for Windows Infrastructure) included index as following.
`wineventlog-index` `tsessions`|eval _key = session_id |sort 0 _time|outputlookup tSessions append=true