Thanks for the reply, but the user is able to get the error logs of the 2 indexes "A & B" when he just give the word "Error" . So, my user is requesting that he also wants the logs of Index "C" when he type "error". I have given him the solution to use searching for 3 indexes as said below, but, he is asking, when am getting the logs of the 2 indexes which are in the same app, why not the log of the Index "C" which is also in the same app.   So, do we have any possibility to get that done? His key search word ONLY "error" should fetch the logs of all the 3 indexes? ... View more

how can you fix this issue when you have thousands of buckets in pending? I have around 4800 buckets and i cannot go and execute roll command on each and every Index right? Can you give me any solution for this please? Thanks for the answer.   @jbarlow_splunk  ... View more