We are seeing strange behavior after updating Splunk from 8.0.4.1 to 8.2.4.
The major issue is with all queries that use the streamstats command; after observing this behavior, we updated the command to include the time difference as well, dividing over the time delta when computing the difference between the two events.
Occasionally, graphs display regular statistics for a short period of time before switching to an abnormal view (due to dashboard auto refresh).
If anyone encounters such a problem, please let me know since most of our dashboards are affected, and we attempted to generalize and adapt this to all of these dashboards in the hope that this will cure the problem.
