Hello Siddigi, If you are referencing to the stanza max_searches_per_cpu = * The maximum number of concurrent historical searches per CPU. The system-wide limit of historical searches is computed as: max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches * Note: the maximum number of real-time searches is computed as: max_rt_searches = max_rt_search_multiplier x max_hist_searches * Defaults to 1 then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables. It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist. Please have a look at the documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf. ... View more

Hello, You can put specific strings with quotes like sourcetype=x "string"|..../sourcetype=x NOT "string"|.... this will give you the events containing/not with the string. Or you can go for match/searchmatch in eval http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions Thanks ... View more