Apparently splunk is behaving correctly, but sometimes using historical searches in order to reduce search time does not work. I only see in the splunkd log several similar messages like this:
ERROR DistributedBundleReplicationManager - HTTP response code 400 (HTTP/1.1 400 Bad Request). Error applying delta=/opt/splunk/var/run/searchpeers/SV19APSP027-1520781662-1520781908.delta, searchHead=SV19APSP027, prevTime=1520781662, prevChksum=13407166704320477873, curTime=1520781908, curChksum=14856987335408760282: Latest bundle has conflicting timestamp: searchHead=SV19APSP027, actual=1520
But also other messages like this, although doesn't seem to be related:
ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=http://SV19APSP027:8000/app/search/search?q=%7Cloadjob%20rt_scheduler__acalasanz__search__RMD58cdfb26d24a1b7d9_at_1520870880_29688.0%20%7C%20head%201%20%7C%20tail%201&earliest=0&latest=now" "ssname=SPK0003-US-Cambio de Contraseña" "graceful=True" "trigger_time=1520871180" results_file="/opt/splunk/var/run/splunk/dispatch/rt_scheduler_acalasanzsearch_RMD58cdfb26d24a1b7d9_at_1520870880_29688.0/per_result_alert/tmp_0.csv.gz"': ERROR:root:[Errno -3] Temporary failure in name resolution while sending mail to: acalasanz@bancopromerica.com, lcastellanos@bancopromerica.com, hucles@bancopromerica.com
... View more