For some reason, after upgrading Splunk to 7.1 some searches no longer return the results for certain days; instead of returning the right day's results, it repeats old dates. If I click a date like 4/4-4/5 in search for the last 30 days, it will return results from 4/19 instead. If I add a filter to host, then everything works correctly and I can see results. I can also search the entire year and all of the results are returned as well. There's nothing special going on aside from a few field extractions here and there. Is this a known bug? I thought at first it may have been related to cached JS files locally but I've cleared my cache and also tried a number of variations to try to fix this to no avail. The only thing that consistently works is zooming out to the year, or setting the exact host. This also affects exporting the results among other things. ... View more

I've recently upgraded to Splunk 6.6.0 and now seem to be having a problem with one of my indexes; every time I searched it, it would give a warning about reduced buckets that you normally see after tsidx reduction has been performed. Checking the latest warm buckets shows that the *.tsdx files have been replaced by *.mini.tsdx files. I have tsidx reduction enabled, but it should only be reducing them after 30 days, not immediately. In addition, only this index in question has this problem. It's a relatively large index with 416.41 GB out of 488.28 GB in use. This wasn't an issue before on 6.5.3 . I've tried settings auto_high_volume for the index but it seems to have no effect as of now. Checking dbinspect I can see it setting warm buckets to mini immediately: id tsidxState state avg(sizeOnDiskMB) 4163 mini warm 314.828125 4164 mini warm 13.57421875 4165 full hot 791.87109375 4166 full hot 0.43359375 4703 mini warm 307.6640625 4704 mini warm 134.53125 4705 full hot 760.03125 4706 full hot 0.5078125 4707 full hot 0.03125 After more investigation this seems to be related to logs that are received in the future due to a missing timezone; logs in UTC are received 4 hours in advance which then triggers an automatic tsidx reduction to occur automatically. Seems like a Splunk 6.6.0 bug..... ... View more