Still looking for an answer as this problem can not be explained. Going through the logs, we noticed that between Linux and Windows, the search log differs: On Linux, I have 03-21-2019 18:43:56.676 INFO CMBucketId - CMIndexId: New indexName=audit inserted, mapping to id=2 03-21-2019 18:43:56.676 INFO BatchSearch - index: _audit dbsize=1 03-21-2019 18:43:56.676 INFO UnifiedSearch - Initialization of search data structures took 6 ms 03-21-2019 18:43:56.676 INFO UnifiedSearch - Processed search targeting arguments 03-21-2019 18:43:56.676 INFO StatsProcessor - No group-by fields specified, incompatible for high cardinality improvements 03-21-2019 18:43:56.676 INFO LocalCollector - Final required fields list = _subsecond,index,prestats_reserved,psrsvd_ 03-21-2019 18:43:56.676 INFO UserManager - Unwound user context: ecoquelin -> NULL 03-21-2019 18:43:56.676 INFO UserManager - Setting user context: ecoquelin 03-21-2019 18:43:56.676 INFO UserManager - Done setting user context: NULL -> ecoquelin 03-21-2019 18:43:56.676 INFO BatchSearch - Searching index:_audit with LISPY:'[ AND ]' 03-21-2019 18:43:56.686 INFO SearchOperator:kv - no fields required. Running only non-optimizeable extractions ... 03-21-2019 18:43:56.700 INFO UserManager - Unwound user context: ecoquelin -> NULL On Windows, I have 03-21-2019 18:39:28.928 INFO CMBucketId - CMIndexId: New indexName=audit inserted, mapping to id=1 03-21-2019 18:39:28.930 INFO BatchSearch - index: _audit dbsize=5 03-21-2019 18:39:28.930 INFO UnifiedSearch - Initialization of search data structures took 7 ms 03-21-2019 18:39:28.930 INFO UnifiedSearch - Processed search targeting arguments 03-21-2019 18:39:28.930 INFO StatsProcessor - No group-by fields specified, incompatible for high cardinality improvements 03-21-2019 18:39:28.930 INFO LocalCollector - Final required fields list = _subsecond,index,prestats_reserved,psrsvd_ 03-21-2019 18:39:28.930 INFO UserManager - Unwound user context: reda -> NULL 03-21-2019 18:39:28.930 INFO UserManager - Setting user context: reda 03-21-2019 18:39:28.930 INFO UserManager - Done setting user context: NULL -> reda 03-21-2019 18:39:28.931 INFO BatchSearch - Searching index:_audit with LISPY:'[ AND ]' 03-21-2019 18:39:28.932 ERROR LocalCollector - sid: bad allocation Field extraction algorithm may be different from Windows to Linux... Any pointer ? Please help ... View more

This is typically because the add-on is installed without SA-Hydra and SA-VMNetAppUtils. This is a valid configuration if you install on you're indexer in a distributed environment. To fix it on the indexer (do not do this on DCN's SH's or anything other than indexers, assuming they're reporting the warning): Delete the .spec files in the README directory, delete the inputs in default and delete all the sample files and restart Splunk on the indexer. If you are using clustering this should be done on the cluster master. If this is a DCN, or your Search Head, then make sure you copy the SA-Hydra and SA-VMNetAppUtils's along with the TA. ... View more