Knowledge Management

Summary Index: Why is a search that took less time before taking much longer now?

chinmayc469
Explorer

Hello,

I am running a saved search(every 5 min) to populate a summary index using collect command.

Now the search on the summary index is taking too much time to give results. Earlier it was not taking as much time.

What could be the reason for this delay in giving results? Ideally search query on summary index should give results quickly right?

When i searched _internal index for errors, i saw error msg "ERROR IndexScopedSearch - STMgr::distinct_apply_terms failed (rc=-33) while scanning for _indextime bounds in bucket".

Is this error related to my issue?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...