Hi we have two searchheads s1 and s2 and two indexers i1 and i2. I am getting below error Unable to distribute to peer named scsplunkiprdrk01v at uri https://scsplunkiprdrk01v:8089 because replication was unsuccessful. replicationStatus Failed Expected common latest bundle version on all peers after sync replication, found none. Reverting to old behavior - using most recent bundles on all I am not sure what should I do in this case. We were having disk space issues on the indexer i2. we deleted some bundle files from both indexers. no errors in splunkd logs as well. ... View more

Below is the data in my index named index ETS=20180921 CNT=161756 BRAND=A INDICATOR=Y ETS=20180921 CNT=156203 BRAND=B INDICATOR=Y ETS=20180921 CNT=12354 BRAND=C INDICATOR=Y ETS=20180921 CNT=26267 BRAND=D INDICATOR=Y ETS=20180921 CNT=1014571 BRAND=E INDICATOR=Y ETS=20180921 CNT=2323 BRAND=F INDICATOR=Y ETS=20180920 CNT=158563 BRAND=A INDICATOR=Y ETS=20180920 CNT=156174 BRAND=B INDICATOR=Y ETS=20180920 CNT=12332 BRAND=C INDICATOR=Y ETS=20180920 CNT=26248 BRAND=D INDICATOR=Y ETS=20180920 CNT=1013469 BRAND=E INDICATOR=Y ETS=20180920 CNT=2321 BRAND=F INDICATOR=Y where ETS is the date, cnt is the count, brands are A B C etc and and indicator. I want to know how to get the percentage change in today's count by brand w.r.t. the average of 90 days. (Currently it has data for 2 days only) . I am able to get the sum by brand, but not able to divide it by the days to get average .. also, I am not able to use that further to decrease from today's value. please help. ... View more