Support for multisearch and multithreaded Splunk queries was introduced with ICA version 6.5.4; however, searches with 'Index = ' at the start of the search header fail. The following errors are recorded in the Splunk importer log:
[1:DEBUG] SplunkApi.MoveNext() Creating job...
[1:DEBUG] SplunkApi.MoveNext() Awaiting Job Creation...
[4:ERROR] SplunkApi.MoveNext() TaskCanceledException Count 0 - continue.
[4:ERROR] SplunkApi.MoveNext() System.Threading.Tasks.TaskCanceledException: A task was canceled.
The Splunk importer prepends a standard search term to queries that do not begin with a pipe character and exceed seven characters in length.
Release : 6.5.4
Component : Splunk Importer
This is a confirmed defect that will be addressed in an upcoming release of ICA.