The scheduled search works most of the time, so it's not permissions. /var/groupon/splunk/var/spool/splunk has quite a few files, will a name collision explain this? And then I guess the next question is, why are there so many files there? Files should only live there for the duration of indexing. Some files are fra mid November and we are early December now. ... View more

Update for the Common Information Model link. ... View more

There were a bug in the app for distributed searches, fixed in 1.1.3 see http://apps.splunk.com/app/368/ Or install the app on all the search-peers. ... View more