Entity xxxxidx2 in KPI Indexers -How to resolve th... - Splunk Community

Splunk ITSI

See i am getting this type of error message in ITSI.

Entity xxxxidx2 in KPI Indexers - Indexing queue associated with service Indexers was dropped from cohesive analysis. Maximum entity limit is 30.

Please help to solve this issue.
Thanks in advance

You have configured an anomaly detection but you have to many entities, maximum ist 30.
https://docs.splunk.com/Documentation/ITSI/4.13.1/SI/AD

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...