It would help to know what you've already tried.  Have you looked at it the other way, that is, what sources do each DM use? | tstats count from datamodel=<DM name> by source You  should be able to combine that with | rest /services/data/models and map to list the sources used by all datamodels. ... View more

Have you checked the _audit logs to confirm user and roles values? ... View more

Jobs should be removed from the dispatch directory automatically once they expire. Some workarounds to consider: Increase the size of the dispatch directory Reduce how frequently datamodel accelerations run Disable unused DMAs ... View more

Hi @Zarack You look to be on the right track.  Give this a go ... index=idx_checkpoint earliest=now latest=+10y | eval indextime=_indextime ,timediff=(_time - indextime) | where timediff > 60 | eval indextime=strftime(indextime, "%Y-%m-%d %H:%M:%S") | table host _time indextime timediff Note, the UI renders _time in a local time format but it's really an epoch time value. Hope it helps ... View more

 there is crash logs on the server in $SPLUNK_HOME/var/log/splunk/crash*.log it gets ingested under sourcetype=splunkd_crash_log ... View more

It seems that the real issue was missing —target parameter as @richgalloway @said. Anyhow I prefer always to use FQDN or short names and avoid IP numbers. That way you could jus5 update DND or hosts files when you are doing maintenance instead of change splunk configuration settings which (almost) all times means shorter or longer service break. ... View more

To collapse those after the append, you just need to use  | stats list(*) as * by common_field but you need to have that common field. In your first search, the lookup is named lookup_vazia, but in the append it's lookup_editada. If you make the field name the same in both cases and rename the first count to something else, so it will not conflict with the second count and do the stats above. Note that list(*) will only produce 100 rows max per lookup - if you use values, it will sort each multi-value field, so the time, user and namespace fields will not correlate. If you need to handle that, I suggest you combine those 3 fields into a single field in the append and then user values(*) so you will get all values.   ... View more

Sorry, in this case I meant that we also need to see if the Lookup was edited ... View more