Hello ikulcsar I would highly suggest to download the currently installed 4.3.x as a backup installer in case you would want to revert when an issue arises and backup your current configurations before upgrading. For some reason (by my experience on installing UFs on different types of OS), I have encountered some version incompatibility issues esp. on AIX and solved some of those by downgrading or upgrading the UF. Also check the release notes of the UF that you will install. After the installation/upgrade, always check splunkd.log for errors. Hope it helps! Thanks! ... View more

Hello @test_qweqwe It's like a whole set of logs automatically arranged with their rightful fields. I'll give an example: Splunk field: chocolate Field values of chocolate: - dark - milk drilldown on field values: dark - 40% - 50% - 80% milk - goat's milk - soy milk - cow's milk As per Splunk docs, Data models are composed of datasets, which can be arranged in hierarchical structures of parent and child datasets. Each child dataset represents a subset of the dataset covered by its parent dataset. Hope it helps! Thanks! ... View more

Hello gcescatto Try installing the Splunk Dashboard Examples app. Though you'll have to do some customization, the codes can be copy-pasted and is very straightforward. Here's the link: https://splunkbase.splunk.com/app/1603/ You'll have to provide your own set of smileys and assign a number range from it. Check this blog below for more details: https://www.splunk.com/blog/2014/03/17/custom-icons-in-splunk-6-tables.html Hope it helps! Thanks! ... View more

Hello @mdzaman, Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data. Example: Your License: 100GB Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization. If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license. See link below for more details on the NEL https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses Hope it helps! Thanks! ... View more