Hello splunkers:
Some data associations were included in the schedule report. After running it, it was found that some data could not be associated with it, but it could be associated with it again when manually running the report the next day.
It was suspected that the search head task was too heavy when running the scheduled report, which led to the loss. Could you tell me how to troubleshoot it?
thanks in advance.
