Greetings Fellow Splunkers,
We have been recieving false reports claiming certain index, sourcetype and ip combinations that havent been communicating for a long time, however when checking over we do actually seem to be recieving a healthy amount of logs from the combination of fields mentionned above.
I have seen this in 2 other organizations aswell, what are some recommended fixes for this issue? has anyone else come across the same problem?
Thanks,
