I think you should ask a linux admin for help ... View more

Sorry for the confusion and thank you for the clarifications. The way we are setup our apps contain indexesI what I was trying to ask was if a users is requesting that new log files be sent to a previously created index, how do I go about finding the particular index and how do I point the log files to the index. We also have forwarder manager. ... View more

Have them give you the exact search they are running, and the results. First, make sure that the search they are kicking off is a consistent search. Make sure it has a fixed earliest and latest value, and so on. If they are kicking off "last 30 minutes" on one head then later on another had, then of course the answer will be different. Second, run that query yourself on each head. See if your results are the same or different from his. Ideally, limit the search to as small a time range and amount of detail as possible, as long as he gets a different result on each head. If there are lookups in the search, or joins, then run those subsearches independently and check whether they are consistent on the two heads. Perhaps a lookup isn't propagating fully, or whatever. ... View more