Hi @kiran_panchavat  @richgalloway  thankyou for your response! Full error message: Error message : [Indexer-x] The search process with search_id="remote_ip-<xxx>" may have returned partial results. Try running your search again. If you see this error repeatedly, review search.log for details or contact your Splunk administrator. We implemented smartstore for a high volume index a few weeks ago and have since been experiencing issues with search and replication factors not meeting for smartstore enabled indexes. We raised a support case with Splunk about this and they informed us that it is a known bug with no fix version available. We hadn't seen this issue before last week, but it's been showing up in most searches for the past 3-4 days (with smartstore index). Furthermore, we are experiencing search performance issues on the smartstore index; either it takes a long time to fetch results or the search gets stuck if we run the query for more than 24 hours. index configuration: [smartstore_index] frozenTimePeriodInSecs = 15552000 repFactor = auto maxDataSize = 1000 maxHotBuckets = 30 hotlist_recency_secs = 86400maxGlobalRawDataSizeMB = 62914560 homePath = /data/smartstore_index/db coldPath = /data/smartstore_index/colddb thawedPath = /data/smartstore_index/thaweddb remotePath = volume:remote_store/smartstore_index Approx daily ingestion on index: 2TB per day. Local SSD volume size: 16TB Remote location: S3 bucket We're not sure, if we're receiving this error because of search & replication factor issue, Request help to fix.

1. Your problem is not clearly specified. You might want to find out how many users are logged in at some given point in time or which ones are logged in (also possibly counting or not duplicate logins). 2. Do you have a separate login and logout events? 3. Remember that as you're logging only login and logout events you won't find sessions which "overlap" your search time range. For example - if your user logged in at 9am and logged out at 12pm you won't find this session if you only search through 10am-11am because you have no events regarding this session during that time range. (this problem can be alleviated for specific use cases by using summary indexing).

The below 2 commands are not working  | `histogram("event.Properties.duration", 31)` bin "$var$" bins=$bins$ | stats count by "$var$" | makecontinuous "$var$" | fillnull count   What type of graph or visualization would you like to create? Just want to create a dashboard tile to show the metric 

Remember that after each step in your processing pipeline you get only those restults from the immediately preceeding command. So if you do all those | where commands in a row, first one will filter out all those results for which the getperct wasnt more than 50, the second one will filter out (of those remaining after first where) those that do not fit the next condition and so on. So your three wheres in a row are equivalent to | where getperct>50 AND putperct>10 AND deleteperct>80 but you want at least one of those condiitons fulfilled so you want | where (getperct>50) OR (putperct>10> OR (deleteperct>80)    

Hello, Thank you for your answer! I made sure that all the points you mentioned are correctly implemented and also checked the documentation you sent. I fixed the problem by enabling the indexing on the Heavy Forwarder and now the client is appearing in it's fowarder management UI aswell. However, it's still showing in the other instances (Manager Server, Indexers etc.) aswell. Also, I don't want to turn on Indexing on the Heavy Forwarder, to not index data, is there a way to avoid enabling it and still get the client showing on the UI? It's a real pain bug i hope they fix it

Hi @anandhalagaras1, regex substitution is correct. Are you sure about the sourcetype? is there any sourcetype replacement in your data? are there some other Heavy Forwarders  before the one you used for the masking? Ciao. Giuseppe

Hi @sle, good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated

I have replicated the issue and here's what I have found Only the top four values will be shown on the pie chart no matter how many fields are present in the table and no matter what value is used in Minimum Size / sliceCollapsingThreshold if there are: six or more fields at least one of them is significantly smaller than the largest number  the sum of all values is greater than 64,250 Test it yourself: Run this search and look what happens when you change the value of 'f' from 53138 to 53139 | makeresults | eval a=1 | eval b=10 | eval c=100 | eval d=1000 | eval e=10000 | eval f=53138 | fields - _time | transpose | rename column as Status, "row 1" as count       Could someone from Splunk please explain what is going on here, or add this to the known issues?  

Hi @alvesri It sounds like the token from the date picker is not plugged in to any searches on the dashboard.  The searches should look something like this:  <search> <query>index=someindex sourcetype=somesourcetype</query> <earliest>$time_tok$</earliest> <latest>now</latest> </search> Could you share the dashboard's XML?