Hi All,
We have a Splunk saved search in which we are querying same index but multiple sourcetypes like below:
(Index=A sourcetype=A1) OR (index=A (sourcetype=A2 OR sourcetype=A3 OR sourcetype=A4))
Issue is sometimes the events from 2nd part is not returned (Sourcetype A2, A3 and A4) but events from 1st part is correctly returned.
Below are some messages from internal logs:
search_type=" scheduled ", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1, scheduled_time=1521180300, window_time=0
search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0
search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0
