What about this: (oi_vmware is the index name) | rest /servicesNS/-/-/saved/searches | search ( search="*oi_vmware*" ) | fields title author eai:acl.app eai:acl.app request.ui_dispatch_app request.ui_dispatch_app eai:acl.sharing id ... View more

@aecruzp Please accept the answer to help future readers find this solution. ... View more

Hi Just saw this for 7.2.5, fixed issues in release notes: 2019-03-07 SPL-167347, SPL-165968 Frequent searches with outputlookup may trigger highly increased KV Store storage usage or in some cases crash of the mongod process André ... View more

You need to remove them from the cluster on CLI ... View more

Hi.    According to the documentation delivered by splunk support, http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Troubleshooting, does not apply to my case, because the connections to the database were dbxquerys and they are not can be administered by the splunk_db_connect app. Review the official account if there is any parameter that will help you in your problem: http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/database_typesspec ... View more

You can of course simply add _time to the by-clause of that tstats command, and then do some sorting and deduplication to filter out the oldest timestamp for each sourcetype. ... View more

hi.     Well, in the end only the macro was modified referring to the index and everything is working well.     Thanks for the help. ... View more

I would imagine that the macro doesn't exist on the indexers, or the permissions on the macro might be wrong? Was the the app pushed to the indexer cluster? When you are running your search, which app are you in?? Check if the macro permissions are global: Its appears global in my instance. the macro is technically not mandatory for your searches either, was just bet practice to allow the users to change it, so you could technically just not use it as well. hit me up on slack if you are in the chat (splk.it/slack to sign up), I'm @mattymo ... View more

The change must be in the search head side, because this execute the querys and indexers only must be do data indexation funtions in a distribuited architecture. ... View more