Indeed. It seems only the most recent 1000 searches are stored. I'm interested in increasing the retention. Any ideas what controls that retention limit? ... View more

Perhaps not. Ideally I'd be able to identify 5-10 second gaps in the logs, which indicates the "hanging" condition. I'll investigate your hypothesis, thanks. ... View more

Unfortunately I was too quick to mark this as solved. It seems that the "age" always grows to 30s and resets to 0s, indicating that the remote Splunk servers that feed this index are only sending data every 30 seconds, even though the logs are constantly written -- does that sound plausible? If so, how do I instruct the Splunk forwarders to stream data in realtime rather than batching every 30 seconds? ... View more

This was my initial idea as well, but I figured there was a better way. This is a good way to look back at historical data, though, which also comes in handy ... View more

Elegant. Thank you very much. ... View more