Splunk Enterprise OnPrem 9.0.1.
We are troubleshooting an issue where some alerts are beign triggered incorrectly, and found a correlation between this odd triggers and _internal events with sourcetype = splunkd_remote_searches.
The events are described as:
01-18-2023 14:03:00.178 -0300 INFO StreamedSearch - Streamed search connection closed: search_id=remote_<node>_subsearch_searchparsetmp_ ...
What does searchparsetmp mean in the context of the subsearch?
Also whats is the difference with remote_<node>_subsearch_scheduler_ ... also describing similar events on _internal?
