Hello everyone! I've tried looking at the _internal splunkd logs but couldn't make sense out if it. Boss is asking why there had been, suddenly, an abnormal gap between the events we're ingesting for a particular period in time. It's back to normal but we're trying to figure out what happened. I couldn't figure it out. Thanks in advance for any input you can provide. ... View more

What is the industry practice for setting the home and cold sizes? If home + cold = maxTotalDataSizeMB, should we a.) home - 50% cold - 50% b.) home - 30% cold - 70% c.) home - 10% cold - 90% d.) others Hoping to get enlightenment from the crowd. Thanks a lot! ... View more

We have an alert which sends email for every result. In the query, there is a sorting process which is important in the sequence of our email notifications. Say our SPL is like this: ... | sort Hierarchy | table Hierarchy, Field2, Field3 For example, the query above results to a 5x3 table (5 rows) .: Hierarchy Field2 Field3 1 aaa zzz 2 bbb yyy 3 ccc xxx 4 ddd www 5 eee uuu What we notice is our MS Outlook receives the 5 emails not in order. It's very important for our stakeholders to receive these email notifications in order. Is there some kind of a documentation (which I can't find, that's why I'm asking here) that will confirm that the reason for this is because Splunk performs the send email function asynchronously or in multiple threads instead of synchronous or single thread? Or are there other explanations? ... View more

So, we have an alert that sends an email with URL that links to the dashboard. We can easily craft that URL for the exact URL the dashboard creates when filters are made... But when we click the URL, it goes straight to the dashboard but the dropdowns / filters aren't selected as expected.. How do we do this? Sample of the URL that sets 6 dropdown filters ..?form.tokCoverage=-5d%40w1&form.tokMilestones=&form.tokJob=&form.tokEnv=SIT5&form.tokProcDate=21%2F06%2F2019&form.tokAsset=OBP ... View more