Hi, Did anyone succeeded with configuring Splunk with HCP? CacheManager is able to upload and download buckets - it works perfectly.   But every time Splunk tries to freeze bucket, transaction fails with error 501 (not implemented). The same if I try to do it from splunk CLI to manually remove bucket/file. WARN S3Client - command=remove transactionId=0x7fb4332dXXXX rTxnId=0x7fb427bfXXXX status=completed success=N uri=https://splunk.XXXXXXXXXXX.com.pl/buckets/test/db/d7/cd/66~7FD81528-13C4-4063-A45C-26DE9D698D42/receipt.json statusCode=501 statusDescription="Not Implemented" payload="<?xml version='1.0' encoding='UTF-8'?>\n<Error>\n <Code>NotImplemented</Code>\n <Message>Only the current version of an object can be deleted.</Message>\n <RequestId>160104XXXXX31</RequestId>\n <HostId>aGNwLXIuYmXXXXXXXXXXXXXMTA4</HostId>\n</Error>\n\n" We tried to disable and enable versioning on HCP, does not help. Had anyone such issue? What additional is needed to configure on HCP or Splunk. ... View more

Hello everyone, I have a report that runs every 10 minutes and have timerange defined: earliest = -10m@m and latest = @m. It should cover all data from indexes if scheduler delay is below 1 minute. But if I set a schedule window to 2 minutes, and if scheduled search is run 2 minutes later (for example 8:42 instead of 8:40) - which timerange this query would cover: 8:30-8:40 or 8:32-8:42? ... View more