no . of search head -1 (8 cores) no. of indexers - 4 (24-cores each) So, my system-wide concurrent searches limit is 32. Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches? OR should I increase more CPU cores in search head also? I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?! Please advise me. ... View more

When my search runs for more than 10 min, 'job-id' expires since the default TTL value is 600 (10 min), so I get "unknown sid" in the search view. I tried to recover the job by the option "Send job to background" - which should ideally extend the particular job-id's TTL value under the metadata.csv in dispatch folder. However, since the folder itself gets removed, there is no possibility to reset the value, whereby there is no action in the search head when I click "Send job to background". Is this a known issue ? Please advise ... View more

How does data model acceleration help in generating a report faster? Creating a new data model from a 'root event' - and several child objects created using constraints - make a complete data set. When I accelerate a data model (Eg : choosing a time-range of 7 days), it creates a directory under the same index with new folder 'datamodel_summary' What are the fields getting accelerated? OR what kind events are stored in the data model summary? How does the 'optional' & 'required' attributes impact acceleration? Are only the required fields accelerated? How does the 'accelerated index' of a data model differ from an actual index? What would the metadata structure be? ... View more

Is there any built-in command to fetch events before and after (for a specific time-duration) a particular keyword/eventtype ? I wanted to filter events with a specific keyword ( index=* host=10.0.0.1 keyword=account-locked) - this will get me the events with these keywords Now, I wanted to fetch events occurred before and after 30 min at this particular event. Please help. Thnx ... View more

Splunk query to get , Actual retention set for an index Remaining days left to meet retention date Current Index_size ... View more

Amount of data sent by forwarder Vs Amount of data indexed Vs License usage Vol. Vs Size of Indexed data on Disk ideally, Amount of data sent by forwarder = Amount of data indexed (Considering no logs are directed to nullqueue) E.g. 60MB data / min (Splunk forwarder ---> Splunk Indexer) Here, are my assumptions, Amount of data sent = 60mb Amount of data indexed = 60mb License usage = 60mb Size of indexed data on disk = ? (Is there any metrics to identify this field ?) I do run various search against metrics.log to analyze: speed of indexing amount of data sent by hosts from forwarder to indexer License usage by hosts Is there any way we can correlate the above fields and derive the size of indexed data on disk? Any help is much appreciated. I would like to create a dashboard comparing these fields / on a daily-basis help on this will be much useful ... View more