I'm seeing the following error message in splunkd.log: 09-16-2019 11:24:24.095 +0000 ERROR AdminHandler:PersistMessages - Failed to remove message: IDXCLUSTER:SEARCHHEAD_INCOMPLETE_GENERATION_https://10.1.1.5:8089 Does anyone have an idea what that means? What's it caused by and how can I resolve the issue? (I have restarted all the indexers in the cluster, but the error message still keeps popping up) Thank you! ... View more

The scenario: via REST API, a scheduled search runs and updates an index, it adds values: Field1='A', Field2='1'; the splunk job is finished and finalized. via the REST API, the same scheduled search runs again and updates an index, it adds values: Field1='B', Field2='2'; the splunk job again is finished and finalized. another scheduled search runs and checks the content of the index ... but sometimes it only sees values Field1='A', Field2='1' ... it doesn't see the values submitted to the index the second time. When I run the same scheduled search a bit later, I already can see the values Field1='B', Field2='2'. So, maybe it's a part of an optimization, but I would like to make sure in this particular case that when a job is done, the data is always available for another search after that. Is there a way as how to achieve that? Thanks for any help! ... View more