Good Morning Team, We recently installed Splunk Enterprise Security Suite and am configuring the settings. I had orphaned searches which were fixed. Now I am getting the below error. I have included a few lines of the text errors. Search Lag Root Cause(s): The percentage of high priority searches lagged (100%) over the last 24 hours is very high and exceeded the yellow thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=1. Total lagged Searches=1 07-07-2020 08:49:22.130 -0400 INFO SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;_ACCELERATE_DM_Splunk_SA_CIM_Performance_ACCELERATE_", search_type="datamodel_acceleration", user="nobody", app="Splunk_SA_CIM", savedsearch_name="_ACCELERATE_DM_Splunk_SA_CIM_Performance_ACCELERATE_", priority=highest, status=success, digest_mode=1, scheduled_time=1594126140, window_time=0, dispatch_time=1594126143, run_time=18.078, result_count=74, alert_actions="", sid="scheduler__nobody_U3BsdW5rX1NBX0NJTQ__RMD5534aac642f80d961_at_1594126140_8224", suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool="" 07-07-2020 08:49:18.705 -0400 INFO SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;_ACCELERATE_DM_Splunk_SA_CIM_Intrusion_Detection_ACCELERATE_", search_type="datamodel_acceleration", user="nobody", app="Splunk_SA_CIM", savedsearch_name="_ACCELERATE_DM_Splunk_SA_CIM_Intrusion_Detection_ACCELERATE_", priority=highest, status=success, digest_mode=1, scheduled_time=1594126140, window_time=0, dispatch_time=1594126142, run_time=15.251, result_count=93, alert_actions="", sid="scheduler__nobody_U3BsdW5rX1NBX0NJTQ__RMD5eddd0618b168fff8_at_1594126140_8223", suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool="" 07-07-2020 08:49:10.432 -0400 INFO SavedSplunker - savedsearch_id="nobody;SA-ThreatIntelligence;Threat - Correlation Searches - Lookup Gen", search_type="scheduled", user="nobody", app="SA-ThreatIntelligence", savedsearch_name="Threat - Correlation Searches - Lookup Gen", priority=default, status=success, digest_mode=1, scheduled_time=1594126140, window_time=0, dispatch_time=1594126143, run_time=5.586, result_count=1, alert_actions="", I have gone through each part of the applications listed and do not have any saved searches that need to be rebuilt or
... View more