After enabling the Distributed Management Console on an Enterprise Security (ES) search head, searches stop returning results. The following additional behaviors were also experienced.
1. Navigation to the Settings menu in the UI is slow but works.
2. When trying to access the Search UI, Splunk does not respond.
3. Running a search from the command line does not return results.
4. The “Scheduled time” value in “Settings > Searches, reports, and alerts” contains dates from the past.
5. Large gaps in time (more than 24 hours in some cases) were seen in the scheduler.log and splunkd.log files.
Why is this happening?
↧