@yko84109, please follow the instructions given by @inventsekar at Subsearch produced 50000 results, truncating to maxout 50000 ... View more

Migration of Splunk and the quotas don't go hand by hand and as @mdsnmss said ignoreOlderThan is a key feature here. Unfortunately, it's a one time deal per forwarder. You can potentially do it for a set of forwarders per day and then set another group of forwarders with the ignoreOlderThan in the next day - not a simple task. ... View more

Do you have any code that you attempted to use? ... View more

The command you posted is for the cluster master and then you need to adjust each indexer and SH. All looks good in the command itself and we just had a discussion about this topic at What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster? ... View more

@jnudell_2, for the record we ended using - LINE_BREAKER = ([\r\n]+\*+\s+END\s+OF\s+LOG\s+\*+\n) And my colleague suggested to add the \n part - not sure if it changed anything. I do see the closing line in the Splunk event - ********************************* END OF LOG ********************************** . Is it right? ... View more

Thank you @mdsnmss. ... View more

Interesting, my colleague also suggested to use .\splunk.exe list inputstatus instead. Which one is better? We ended up using the Power Shell command interface. ... View more

Sure thing @DavidHourani - thank you as always for your insights and positive energy. ... View more

Makes sense - thank you @FrankVl. ... View more

Can you please place here part of the original CSV file data with these non-ascii characters? ... View more

And the SE added - -- There is no way to combine tstats with eval. tstats is used to reference either a datamodel or the index metadata. If it’s a datamodel it may be worth adding the eval’d field to the datamodel if this is an important usecase. ... View more

Our user asked - -- Thanks, I was curious about the efficiency of the SPL. A lot of times the queries I run hit up against memory limits, so getting more familiar with the memory usage of SPL is getting to be more important for me. I’m pretty familiar with the actual usage/syntax of that, but wasn’t sure about the efficiency. Following on that, I know | tstats by default does not allow nested eval expressions. Is there another way to get the efficiency benefit of nested evals inside a tstats ? ... View more

The SE added - -- Yeah not much to add. The difference in practice will be pretty small to be perfectly honest. Same number of events, same number of computations, but doing them together will allow for better threaded-ness and memory efficiency. ... View more

Interesting @DavidHourani. ... View more

@FrankVl, the documentation says - -- When you initiate a rolling upgrade, you select a peer and take it offline. During the offline process, the master reassigns bucket primaries to other peers to retain the searchable state, and the peer completes any in-progress searches within a configurable timeout. See The fast offline process. After the master shuts down the peer, you perform the software upgrade and bring the peer back online, at which point the peer rejoins the cluster. You repeat this process for each peer node until the rolling upgrade is complete. Pretty amazing. @FrankVl, we are not in maintenance mode, right? ... View more

You are a real gentleman @jkat54 ; -) ... View more

Thank you @DavidHourani ... View more

Absolutely @DavidHourani - we'll throw this idea out the window ; -) ... View more

From the SE - I mean… why would you want to do that? You’d only be building up more back pressure. The behavior you saw after upgrade is a positive thing. Without this extra work by the indexers your data is unsafe and easy to lose forever. If you want to tweak the behavior to make it more manageable check out workload management in 7.2.x and above. If you didn’t do a site-by-site upgrade (I thought you did?), site-by-site would reduce the fixup count significantly. ... View more

From the SE - -- Looks like you have your answers already. Site-by-site upgrades work in most cases. There are caveats with certain breaking change type upgrades, but those are really rare, the most recent one I can remember is the SSL version change. 7.1+ does also allow for rolling upgrades as mentioned in the answers responses. This is likely your best path forward. ... View more

Gorgeous @FrankVl. ... View more

nofiles(descriptors) 2000 is almost the minimum - it should be higher. ... View more