How long should we maintain the logs in the directory to be monitored? If the log file is reaching the size limit, will a new file will be created? its upto you, for example you can maintain for 1 day and new file will be generated after 1 day. Will Splunk capture the old information and the new information without losing data? yes How quickly will Splunk capture the information and index it? as soon as splunk forwarder process reads data from file and sends to indexer , actually it will not take much time and can be in real time if everything works fine like network latency , buffering etc http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf ... View more

you can try transpose in your event(_raw) field http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transpose ... View more

try this search 1 | join type=left [search2] | eval diffTime=dateofSearch2 - dateofSearch1 ... View more

you need to install "splunk addon unix and linux" add-on in forwarder in your linux system https://apps.splunk.com/app/833/ ... View more

try this your search|rex field=_raw ".is not cartonable.(?<item>\d{8})."|chart count by item ... View more