Hi We recently upgraded our Splunk instance from 4.0.10 to 4.1.4. After the upgrade we are seeing the following error being generated from one of the charts using a summary-indexed query: Error in 'IndexScopedSearch': The search failed. More than 125000 events found at time 1286150400. The query is of the form: index=summary s_name="blah" | stats count as s_count by orig_host, field1, _time | timechart sum(s_count) by orig_host This chart worked fine in 4.0.10. Thanks for your help. Ranga ... View more

Hi We have a saved-search that retrieves data from an existing summary index. It is of the following form: index=summary s_name=blah | stats count as inner_count by field1 field2 _time | bucket span=1mon _time | sistats sum(inner_count) as outer_count by field1 field2 _time The above search is saved with a marker: s_name=blah2 . When I try to retrieve this in a dashboard using the following query, the outer_count always shows up as 0. index=summary s_name=blah2 | stats sum(inner_count) as outer_count by field1 field2 _time Any help is appreciated. Ranga ... View more

Hi We have a 4.0.10 instance deployed in production and are currently investigating 4.1.2. We are noticing some changes in the way summary-indexed based saved searches work in 4.1.2. We have enabled summary-indexing on our saved-searches and they have an optional parameter like: report = search_report_name The above searches work fine in 4.0.10. But in the 4.1.2 instance, all of these searches generate the report value with the the date and time appended to them. For the following search: index=summary | top report limit=0 In version 4.0.10, we get: report count percent report_name_1 8000 25 report_name_2 8000 25 report_name_3 8000 25 report_name_4 8000 25 But in version 4.1.2, we get: report count percent report_name_1 09/03/2010 12:00:00 50 3 report_name_1 09/03/2010 11:00:00 50 3 report_name_1 09/03/2010 10:00:00 50 3 report_name_1 09/03/2010 09:00:00 50 3 ..... ..... ..... This behavior basically renders our queries useless, since we are specifically looking at the report name. Appreciate any help on this. -Ranga ... View more