Hardware limitations related to memory consumption by the search head. They are solved by adjusting the memory configuration.
Software limitations related to the cache. Sometimes we should delete the old cache using command rm -rf <vix.splunk.home.hdfs>/cash.
Human factor—this is a popular issue, especially in analytics. We learnt that, for Hunk, acceleration means: same search + same data = same result. But it won't work if we change the KV extraction rules. Be careful with this.