Thanks for giving me some directions.
Well, it's a idx cluster, Splunk version 7.2.0 as said, and the messages are seen on all cluster members.
Actually the error seems to me related to data model acceleration, since all path="..." names have in common:
.../<index_name>/datamodel_summary/.../DM_Splunk_SA_CIM_Web
Any ideas?
... View more