I am using this search to find volume for systems reporting to one index index="_internal" source="*metrics.log" per_index_thruput series="Customer_Index_group" | stats sum(kb) as kb_indexed | eval GB = round(kb_indexed/1024/1024,2) | gauge GB 0 7 14 21 28 I can then search the metrics logs reported from the systems like this index="Customer_Index" source="*metrics.log" per_index_thruput series="Customer_Index_group" | stats sum(kb) as kb_indexed | eval GB = round(kb_indexed/1024/1024,2) | gauge GB 0 7 14 21 28 However these two numbers are very different. Granted the search on the _internal index runes much faster, but my users do not have access to the _internal index and they would like to know who much data there index is using. I see a volume that is much larger on the search form index=_internal than they can see using index="Customer_Index". Why would the _internal index show more than the info from the $splunk/etc/var/log/splunk/metrics.log? ... View more

I have a look-up table of systems reporting to splunk from one of my users. He would like to know when one of the systems on the list is not reporting to splunk in the last 24 hours. Any suggestions? ... View more

How can I take the DBX app out of the list of app for users but still leave it viable for admins I can take permissions away from users for the dbx home view and that will keep them out of the app but it still shows up in the available app list for users. I can tun of the "view this app" but this takes it out of the admins list of apps. I can take permissions away from users for the app but then they can not see searches that were created in the app for the users. Any suggestions? ... View more

I have a search like this index="wireless" DHCP ACK | table _time src_mac src_ip I would like to show a table of MAC and the assoseated IP's the MAC has used and when it recieved the IP Like this: fc:c7:34:de:58:56 1/1/2013 123.45.6.789 1/2/2013 123.45.6.978 fc:25:3f:a0:6d:bb 2/1/2013 123.45.6.912 2/3/1023 123.45.6.864 ... View more

I have a number of Linux systems that are reporting to the OS index I need to move to an Organizational index I can do this using the deployment server since they are all reporting to the DS The organization is being charged by the amount of data they put in there index each day I have a list of hosts [index=os host=server1 OR host=server2 OR host=server3 OR host=etc] What would be the best way to fashion a search to see how much data per day will be added to the ORG index whan I move the 93 systems to the new index? ... View more