Thanks @somesoni2 this did not yield any results. Here is my search index=_audit action=search search="*" NOT search="'typeahead*" NOT search="'|history*" search_id="*RMD5e816c6f7615a1e8c_at_1470755400_14045" OR id="*RMD5e816c6f7615a1e8c_at_1470755400_14045" See you at dot conf ... View more

I did the search back 7 days and this is the result... Only one log entry 08-09-2016 11:28:19.963 -0500 INFO SavedSplunker - AlertNotifier::execute: queued sid=scheduler_nobodydatasystems_RMD5e816c6f7615a1e8c_at_1470755400_14045 for action execution ... View more

I think you are asking about what logs generate the most traffic in splunk you can use the punctuation field to find similer logs from different systems like this * | top punct Be sure to use this for only a short time interval (5 or 15 minutes) as this could be a very intensive dense search ... View more

Part of what @lycollicott suggested solved my problem I created a new veritable in splunk-launch.conf then did a global search and replace in all the indexes.conf for the new veritable to the "colddb = $SPLUNK_COLDDB" This will have to be changed for every new index that is created in the future. ... View more

That is a great idea. I will try it. Create Veritable called SPLUNK_COLDDB in splunk-launch.conf Replace "coldPath = $SPLUNK_DB" with "coldPath = $SPLUNK_COLDDB" in 84 locations Is there a way to change the default coldPath for newly created indexes ... View more

thanks that is the answer I was hoping not to get. I was hoping someone had a way to address where the cold buckets were without having to edit all the indexes.conf for all the the apps that have been installed along with all the data sources that have been added. looks like 86 different indexes to edit in about 14 different indexes.conf files and some are default so I will have to create some new indexes.conf. I was hoping for a better answer that the one you provided. Thanks for your help 🙂 ... View more

thanks but there are many indexes.conf to edit. I was looking for something that would change the default behavior. Perhaps something in the splunk-launch.conf where the defualt SPLUNK_DB is located? Thanks for the response. ... View more

Thanks this works great ... View more

@sherm77 sorry to here your upset. @Martin_mueller has helped me with problems in the past and I usealy give half my points when i accept the answer. Sorry Martin g=for neglecting to recognize you some two years ago for this answer. Points to you Martin and sorry to upset you sherm. ... View more

Thank you @acharlieh I just used the rest search you gave me. It seems that the cumulative permissions did take affect for the app and the user does have access to the apps for both roles. The problem is the index's that the roles can search are restricted to the common set of indexes. If the index is not in both roles the user can not search the index. One role has all external indexes and one role has a limited set of indexes. The user with both roles can only search the limited set of indexes. Any suggestions would be helpful. ... View more

this was the answer i used. I change the search just a little but this worked thanks ... View more

I am testing this now. Why is it important to limit the maxsearches? wont this just return only the number of indexes that match the index= criteria? ... View more

I tried the tstats and it is way slower than the metadata as it is actually doing a count ... View more

thanks but I wanted to get the metadata like host, firstTime, lastTime, recentTime, totalCount I keep all my ORG's in different indexes and was asked to provide states from each index along with metrics on each system I don't know if i can get this from tstats? Or do I use tstats with the metadata search? ... View more

without the props the files are read and each line in each file is an event. With the props.conf most of the files are one event. I was hoping to manage this at index time on the intermediate forwarder and not have to manage props.conf on the indexers and universal forwarder. I will start with the indexers, as the UF does not seem like a likely place to put props.conf, and see if this helps Thanks much for the suggestion @jkat45. I was hoping to avoid dispersed management of props.conf ... View more

this same system broke at line 12 4/25/16 12:35:00.000 PM Machine:mysystemname User:myuser Domain:local.com SN:MJMBVCN Asset: OS:Microsoft Windows 7 Enterprise SP:Service Pack 1 Chassis Type:3 CAE:Yes DAR:No MIP:No KACE:Yes linebreak Windows IP Configuration Host Name . . . . . . . . . . . . : mysystemname Primary Dns Suffix . . . . . . . : local.com Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : local.com v Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : local.com Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connection Physical Address. . . . . . . . . : 44-37-E6-93-F6-09 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::50d4:1efa:fb18:b8c%11(Preferred) IPv4 Address. . . . . . . . . . . : n.n.n.n(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Wednesday, April 20, 2016 4:58:43 AM Lease Expires . . . . . . . . . . : Monday, April 25, 2016 4:58:46 PM Default Gateway . . . . . . . . . : z.z.z.z DHCP Server . . . . . . . . . . . : y.y.y.y DHCPv6 IAID . . . . . . . . . . . : 272906214 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-A1-98-02-44-37-E6-93-F6-09 DNS Servers . . . . . . . . . . . : x.x.x.x NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter 6TO4 Adapter: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft 6to4 Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes ... View more

this file did not break 4/25/16 12:38:02.000 PM Machine:mysystemname User:myuser Domain:local.com SN:MJMBVCN Asset: OS:Microsoft Windows 7 Enterprise SP:Service Pack 1 Chassis Type:3 CAE:Yes DAR:No MIP:No KACE:Yes Windows IP Configuration Host Name . . . . . . . . . . . . : mysystemname Primary Dns Suffix . . . . . . . : local,com Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : local.com Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : local.com Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connection Physical Address. . . . . . . . . : 44-37-E6-93-F6-09 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::50d4:1efa:fb18:b8c%11(Preferred) IPv4 Address. . . . . . . . . . . : n.n.n.n(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Wednesday, April 20, 2016 4:58:43 AM Lease Expires . . . . . . . . . . : Monday, April 25, 2016 4:58:45 PM Default Gateway . . . . . . . . . : z.z.z.z DHCP Server . . . . . . . . . . . : y.y.y.y DHCPv6 IAID . . . . . . . . . . . : 272906214 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-A1-98-02-44-37-E6-93-F6-09 DNS Servers . . . . . . . . . . . : x.x.x.x NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter 6TO4 Adapter: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft 6to4 Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes ... View more

@jkat54 @dshpritz, Thanks for the help I tried both of these solutions and neither one is working. There is a logon scripted running on the windows systems and the data collected over writes a file in a shared directory that splunk is monitoring. the splunk UF on the system sends the changed file contents to an intermediate forwarder where i have the props.conf file setting the index time behavior for this sourcetype. then the IF is sending the login events to three indexers using round robin routing. I am still getting one out of 6 event-logs are breaking in the middle of the log file to create two events for one file. Where the "LINE_BREAKER" is executed seems to be random. Thanks for helping ... View more