Hello, I have a simple collect query that looks the like the following: | makeresults | eval test=1 | collect index=collect_test For some reason, i'm getting collected data with enormous delay (in average ~25 seconds, however i had few events with delay about 1500 seconds) To find out the delay value, I am using the next query: index=collect_test | eval delay = _indextime - _time | table _time test delay This issue is reproducible with the mcollect command on metrics index. My environment is just a full Splunk instance on a Windows server with a few forwarders that are sending data to it Any ideas what might cause this behaviour? ... View more

Hello guys I have an index, stored in active directory. Is there a possibility to make my splunk instance extract data from this index? And if so, help me please with direction of movement Thanks ... View more