We have two separate instances of Splunk 6 (A & B) installed on two different servers that are set up independently from each other. I want to search indexes on B from A to display on a live dashboard. Does this require setting up a distributed search? Do I set A as the search head and B as the search peer as described in the Distributed Search docs? Is there anything that I'm missing? Thanks ... View more

I have a real-time search that spans a 5 minute window to count the number of users currently accessing the system. The search is used to load a table module on a live dashboard. If there are no users for a particular app then the app is no longer displayed in the table results. What I need to is to some how create a right outer join for a realtime search. | stats dc(user_id) as user_count by host app How can I display a count of 0 if there are no matching events? I've tried using a lookup table and subsearches, but it doesn't seem that this will work in a real-time search. Any help would be greatly appreciated. UPDATE 1: Expanding comments that do not fit below. In the end, I modified my solution a bit because I needed an additional BY field. Using your guide I came up with the following which seems to work. | eval expander =if(count==1,split(app+":"+host+",app1:host1,app2:host2,app3:host3",","),null()) | mvexpand expander | eval expander_app = mvindex(split(expander, ":"),0) | eval expander_host = mvindex(split(expander, ":"),-1) | rename expander_app as app expander_host as host | stats dc(user_id) as user_count by app host Many thanks again! UPDATE 2: It doesn't seem that this will work in a real-time search. When performing a historical search using your below example, I will receive counts. If I change it to a real-time search I get a count of 1 for all hosts. By the way, I'm using Splunk 6. index=_internal | streamstats count | eval expander=if(count==1,split(host+",host1,host2,host3",","),null()) | mvexpand expander | streamstats count | eval user_id=if((count>1 AND count<5),null(),user_id) | rename expander as host | stats c as user_count by host UPDATE 3: Working solution It appears that the issue is with the mvexpand. Null values will not expand in a real-time search. Keeping with the same example, I needed to modify the expander line and to create a new host field using eval and not simply renaming. This now seems to work as expected index=_internal | streamstats count | eval expander=if(count==1,split(host+",host1,host2,host3",","),"") | mvexpand expander | streamstats count | eval user_id=if((count>1 AND count<5),null(),user_id) | eval host=if((count>1 AND count<5),expander,host) | stats dc(user_id) as user_count c(host) as host_count by host ... View more

Will summary index searches be queued up for a certain amount of time or will the searches simply be skipped and a backfill script will need to be run to fill in any gaps? ... View more