Out of curiosity, I'd want to know that why did you setup a new deployment rather than upgrading your existing one ? There must be a good reason for why one would increase the task level manifolds. Now for your answer you can perform some of the following validations - 1. Compare licensing volumes. Overall and Per sourcetypes. 2. Compare knowledge objects e.g. Fields, Tags, Event Types, DMs, Lookups, Macros etc. 3. DM accelerations. These would be important if any of your searches are based on them. 4. Users and Roles 5. Any external Authentications that you might be using. 6. Apps and Addons. [It'll be important to take note about if there are any customizations done on the Apps and Addons you are already using]. May be keeping copy of /local directory of these apps and addons would help. Now you can choose about how much thorough you want to be while checking on these pointers above ... View more

You'd have to combine the remaining input sources (which you want to show as Other) as one and then apply your stats function on it. That will solve it for you. E.g. Lets say you have input_source values as - A, B, C, D, E, F, G, H. You want A, B, C, D, E to reflect as they are and remaining F, G, H as Other. You need to do an eval before your stats command which would combine F, G, H in one. Something like - ....... | eval input_source = case(input_source == "F", "Other", input_source == "G", "Other", input_source == "H", "Other", 1==1, input_source ) | stats ... Basically, with above eval, your input_source will now have the values as - A, B, C, D, E, Other. So when you do a stats like - | stats count by input_source This would create your Pie Chart with your 5 required input sources and combine the rest in "Other". Hope this helps. Please accept this as an answer if it resolves your problem. ... View more

I think you are experiencing the same problem as observed here - https://answers.splunk.com/answers/178485/why-am-i-getting-cooked-mode-v3-data-testing-tcp-i.html Please validate you settings for the accepted answer in the above post. OR else we might want to look at more errors/warns from _internal index specific to the ports you are using. Please mark as accepted answer if this solves your problem. ... View more