Thanks somesoni2. Query is working smooth index=fortinet [| inputlookup Blackipfortinet.csv | table dstip] dstip!="10.11.1.251" | stats values(srcip) as "Source IP" min(_time) as "First Occurred" max(_time) as "Last Occurred" count(dstip) as destcount by dstip | convert ctime("First Occurred"), ctime("Last Occurred") ... View more

We experienced that some of the errors happened when deploying twice too fast. The search heads were still restarting or executing post-start tasks. The error messages here are a bit misleading. However, I can't recall anymore which ones of the four errors occurred in such a case and whether the issue still exists on first deployment try. ... View more