Hi all, I have a simple question: In a distributed environment (without SH cluster), what happens when I do a distributed search? As I understand the SH opens a connection to the search peer(s), send it/them the search bundle, the search peer(s) execute(s) the search, but then what happens? The search results send back to the SH trough the same connection (what initiate the SH earlier) or the search peer(s) initiate(s) a new connection? In nutshell my question is: In a distributed environment during a distributed search from its start to its end, Do exist only SH->search peer communication direction or not? Thanks in advance! Tamas ... View more

Hi Folks, I have a problem with an ipnuts panel on a dash. If I run the spl in the search I get the needed list. If I'm copy/pasting it into my dynamic inputs dashboard panel' search, I get back nothing: <label>Domain</label> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>src_nt_domain="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>domain</fieldForLabel> <fieldForValue>domain</fieldForValue> <search> <query>index=* (eventtype=msad-failed-user-logons OR eventtype=msad-account-lockout) | fields dest_nt_domain | dedup dest_nt_domain | table dest_nt_domain</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> So I have the win-infra role and all of the permissions. The custom dash' home is the search app, and the I am the owner. I already tried to create a report and the result was the same. Can anyone help me to make my multiselect inputs panel work? Thanks in advance! ... View more