Hi Team, We are facing discrepancy with Splunk License total usage vs Index wise usage. Could you please help us on this?  Our Actual Splunk Stack is 50GB. 1. Index wise License Usage:   for individual index for 1 index showing 65.46GB for the same day Total usage we are getting 55.42GB as shown in below screen shots. 2. Total License Usage: This is the Overall License usage for Feb 15.   Kindly assist us with License Usage query based on index wise and it should match with the total License Usage and indicate any changes that need to be made at the server or configuration level. @gcusello @isoutamo @PickleRick Regards, Siva.

I have been building KV Store lookups with the lookup editor and I have noticed that when I add a line in the UI, when I leave it and come back to it, it duplicates the line multiple times and I have to go back and delete the duplicates.  This seems to happen whether I am copying and pasting or just simply adding a line by hand.  Has anyone else seen this issue or am I doing something wrong?  To add a line I right-click on the row and select add a new line above.  Once I finish the data input I leave the line to commit it.  I go to my dashboard that is displaying the store, refresh and note that there are multiple copies of the line I just added. This does not happen with CSV file lookups, just the KV Stores. Thoughts?  More info?

Hi guys, I am trying to set up a code in javascript which will refresh page after javascript run, because now my dashboards loads, but javascript run first and the visualizations depends on javascript and then coloring for example don't change. When I tried to put refresh under query to 5seconds, then it was reloaded and all visualizations were loaded, but I would like to do it better way and I am sure with javascript is possible, but I am very basic with javascript, so I was searching here, but nothing worked, because mainly it was set up, that after some button click the javascript will reload the page, but I would like to have it automatically. Thank you for any ideas. v.    

Looking to create a report showing the uptime of all hosts in a specific index which ingest data via a UF. I would like to see over the past 30 days, what was the percentage of uptime per host in that index=abc.  I am trying to create a metrics report showing the frequency a host is logging to Splunk.