Knowledge Management

Summary Index: Why is a search that took less time before taking much longer now?

chinmayc469
Explorer

Hello,

I am running a saved search(every 5 min) to populate a summary index using collect command.

Now the search on the summary index is taking too much time to give results. Earlier it was not taking as much time.

What could be the reason for this delay in giving results? Ideally search query on summary index should give results quickly right?

When i searched _internal index for errors, i saw error msg "ERROR IndexScopedSearch - STMgr::distinct_apply_terms failed (rc=-33) while scanning for _indextime bounds in bucket".

Is this error related to my issue?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...