Give this a try
index=x heartbeat AssetType=Linear |bucket span=1m _time | eval DistinctSession=XDI.AssetID | timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType | timechart span=1d max(*) by *
... View more
I ended up deleting the $SPLUNK_DB/persistentstorage/dbx/global as noted in another case, restarting splunk and the problem was fixed! Even though the log error did not mention persistentstorage the fix seemed to work.
... View more