Hi all, We have an issue with our environment (all running 8.2.8 currently on Windows Server 2016 Standard). We have a multisite Indexer cluster consisting of 2 Sites with 2 Indexers in each site and a separate 2 node Searchhead cluster, 1 Indexer Master node. Replication is working as expected and when manually taking nodes offline, search and data durability are effected as desired (for ex. if you take a whole site or a single node in a site offline, everything is still searchable). When a configuration bundle is deployed via the Master node, which requires a restart, all indexers in both sites will restart at the same time interrupting all searches. The following values are present in server.conf (using btool) on the Master node: [clustering] percent_peers_to_restart = 10 restart_timeout = 60 rolling_restart = restart rolling_restart_condition = batch_adding replication_factor = 2 site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 On top of that and also unpleasant is that in many cases for ex. when appyling changes to props.conf for existing stanzas via the Master node, the indexers will restart although bundle validation on the Master returned that a restart is not required. According to forum posts the issue should have been fixed in the 6.5.2 release. This environment however was base installed with 7.x so it cannot be an issue which would have been carried along through upgrades. Any thoughts appreciated. Many thanks and regards     ... View more

Hi, I am asking if it's possible to ingest logfiles where one logline would contain a DateTime and the following lines only contain Time, until the next entry with a DateTime. If we ignore Date as a whole by using a custom time DateTime format only consisting of %H:%M:%S it's using the creation date of the file and the time pulled from the individual event. While that works without issues for files containing less than 24 hours it fails for files containing more than 24 hours of data: ### Job STARTED at 2021/09/21 00:30:00 [INFO ] 00:30:01 This is a test message [WARN ] 01:15:01 This is a warning message ### Job STARTED at 2021/09/22 06:10:00 [INFO ] 06:10:01 This is a test message [WARN ] 07:11:00 This is a warning message Regards   ... View more

Hi, Having major issues with Perfmon collection. Values collected for "% Processor Time" (as well as privileged and user) sometimes contain invalid information. Just monitoring a single 6 vCPU machine. While for some processes the CPU usage is correctly returned as percentage value between 0 and 600, other processes every few minutes return values that are way above charts like a few thousand to for ex. like 1.5 Mio. I cannot see any of those numbers while running perfmon. The process IDs of those process also don't change. Regards         ... View more