Experiencing the same issue on win2003 x64. However there is such file and permissions are ok. Any ideas? Search over the problematic index is very slow. ... View more

Is there a way to re-break old raw data into events again after I modified props.conf. Or should I live forever with that data which was broken into events the wrong way? ... View more

Guys, I suppose this process is running to optimize Splunk service database called fishbucket. Don't you think so? This database is used by splunk even when LWF is enabled. Is there anybody from Splunk support or Splunk guru's to prove this statement? However this version is the same as the answer above I suppose, I've just pointed to a concrete database name. ... View more