I've experienced the same situation.  Batch Reader was reading another large zip file before the one waiting with the message, "updated less than 10000ms ago, will not read it until it stops changing ; has stopped changing , will read it now." Just wait till Batch Reader finishes reading the other large files. Then, the one waiting should be read. ... View more

Try the code below to change the selection of your input. function unsetToken(name) { defaultTokenModelun.unset(name); submittedTokenModelun.unset(name); } unsetToken("form.TEXT_FIELD") ... View more

I saw a similar message below [splunk-idx1] Failed to parse templatized search for field 'tag::eventtype' This error was caused by following forearch command. | foreach * [ eval <<FIELD>> = if(isnull(<<FIELD>>),"",<<FIELD>>)] I think the <> template cannot handle fields contains special characters. I worked around this by adding | fields - tag::eventtype just before the foreach. You can probably work around by adding | fields - 'clientHeaders.test-client-device-id{}' ... View more

There are several options for you. Please see below link for more detail. https://splunk.box.com/v/dataoffload The quick win is the TSIDX reduction. https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage Hadoop data roll would be the next when you have any Hadoop storage space. https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop I hope this helps. ... View more

maybe the disk quota if you see the error for specific user roles. ... View more

Right this one easier and quickly too...!! thanks 🙂 ... View more