Can you share your search? Generally this happens with tables that don't align to how Splunk expects the data. ... View more

Take a look at this app for an example of how to proceed: https://splunkbase.splunk.com/app/3647/ ... View more

When in an environment where I need to do "dev on a budget" I've configured a dev search head to peer the prod indexers. This has some limitations, but is generally a pretty reliable way to build and test apps as you get a full dataset to utilize and you get to ensure that your new saved searches don't over-schedule a block of time. ... View more