How often do you run this saved search? If a saved search is scheduled to run every minute, but it takes five minutes to run, then it will skip the next four times that it tries to run.... ... View more

All right, do you have a sample of the data? What does your props.conf look like for this sourcetype? If your event contains multiple date time entries you need to tell Splunk explicitly what the timestamp is of the event. Apply a timestamp prefix, max timestamp lookahead and timestamp strftime Do you have a monitoring console to check input / indexing issues for that sourcetype? ... View more

First thing that comes to mind is what ip address are you using to go to the url? Make sure that you are using the aws instance external ip. ... View more

Possibly https://gitlab.com/graphviz/graphviz/ ... View more

Hi, I assume you have a multiple instance deployment of Splunk. Have you followed the following steps? https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/Deploymentsetupsteps ... View more

It means that your multiline event has been in cut into blocks of 1000 lines. see props.conf MAX_EVENTS=1000. You could increase this value... But what you really need to do is check the sourcetype and see if you have configured the timestamping correctly. This will make sure the events are better parsed. ... View more

Looks like the error stems from an invalid regular expression, so you'd need to make sure any special characters are appropriately escaped before using them in the regular expression. You probably need to escape the underscores in the regex string for that extraction. ... View more

I'm not sure what you mean with how much time it should take? You mean for events getting ingested into splunk? Is it not working at all? Have you restarted the UF? the fschange function has been deprecated btw. See: https://answers.splunk.com/answers/63874/why-is-fschange-file-system-change-monitor-a-deprecated-feature-in-splunk-5-0.html Have a look at this: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesystemchangesonWindows ... View more

I'm not sure what you are trying to do on a forwarder? You should not install it on the forwarder but in etc/apps directory. MongoDB Admin To receive administrative events from MongoDB hosts, enable a mongo_admin data input under Settings > Data Inputs > MongoDB Admin MongoDB Collection Stats To fetch collection statistics from MongoDB hosts, enable a mongo_collstats data input under Settings > Data Inputs > MongoDB Collection Stats MongoDB Database Stats To fetch database statistics from MongoDB hosts, enable a mongo_db data input under Settings > Data Inputs > MongoDB Database Stats MongoDB Logs There are 3 ways to get MongoDB logs into Splunk: set up a file monitor on the Splunk Universal Forwarder to tail mongod.log on all MongoDB hosts configure mongod to send logs to Splunk via syslog configure the MongoDB Monitoring app to collect logs via the MongoDB Client API by adding a data input under Settings > Data Inputs > MongoDB Logs The MongoDB Monitoring app applies field extractions to the mongod sourcetype. By default the dashboards expect MongoDB logs to reside in the mongodb index with sourcetype mongod. You can change this by modifying the mongo_index and mongo_sourcetype macros under Settings > Advanced search > Search macros. ... View more

Did you read the manual? --> https://splunkbase.splunk.com/app/1438/#/details ... View more

Hi, Maybe this will help you: https://answers.splunk.com/answers/120422/dbconnect-stopped-functioning.html But as woodcock said...go to V3..performance and config is so much better! ... View more

How is it displayed in the actual logifle that is indexed? When I use quotes it works for me: |search index="user_logon" username="Léo" OR username=Leo I have tested this with my splunk instance and this works for me. ... View more

What does the splunkd log say in detail? ... View more

http://conf.splunk.com/files/2016/slides/anomaly-detection-on-business-items-with-machine-learning-algorithms.pdf http://conf.splunk.com/files/2016/slides/machine-learning-using-splunk-and-r.pdf http://conf.splunk.com/files/2016/slides/splunk-for-donuts-optimizing-the-customer-experience-at-dunkin-with-splunk.pdf http://conf.splunk.com/files/2016/slides/splunk-as-an-intelligent-platform-from-log-aggregation-to-machine-assisted-analysis-at-nordstrom.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-working-with-splunk-cloud.pdf http://conf.splunk.com/files/2016/slides/splunking-aws-for-end-to-end-visibility.pdf http://conf.splunk.com/files/2016/slides/real-world-advantages-of-choosing-a-lean-soc-approach-over-a-legacy-soc-lessons-learned-from-the-uks-largest-home-improvement-retailer.pdf http://conf.splunk.com/files/2016/slides/splunk-cloud-at-bbc-worldwide-operational-and-business-analytics-to-support-a-new-digital-service.pdf http://conf.splunk.com/files/2016/slides/using-splunk-to-create-the-first-hipaa-cloud-compliant-infrastructure-at-harvard-to-secure-clinical-and-genetic-patient-data-on-aws.pdf http://conf.splunk.com/files/2016/slides/building-splunk-visualizations-with-the-new-custom-visualization-api.pdf http://conf.splunk.com/files/2016/slides/http-event-collector-in-splunk-more-super-powers.pdf http://conf.splunk.com/files/2016/slides/faster-splunk-app-certification-with-splunk-appinspect.pdf http://conf.splunk.com/files/2016/slides/monitoring-the-industrial-internet-of-things-a-guide-to-application-performance-management-with-splunk.pdf http://conf.splunk.com/files/2016/slides/mqtt-cep-and-the-other-lmnops-of-the-iot.pdf http://conf.splunk.com/files/2016/slides/business-analytics-with-splunk-the-secret-behind-our-saas-growth-success.pdf http://conf.splunk.com/files/2016/slides/splunking-sap-provide-instant-business-value-by-unlocking-sap-data-for-it-ot-and-security-use-cases-across-your-enterprise.pdf http://conf.splunk.com/files/2016/slides/monitor-your-business-transactions-with-splunk-to-gain-real-time-insights-into-your-business-performance.pdf http://conf.splunk.com/files/2016/slides/gaining-new-insight-into-the-payment-business-process.pdf http://conf.splunk.com/files/2016/slides/tracking-trading-fix-environments-with-splunk.pdf http://conf.splunk.com/files/2016/slides/listen-to-the-wind-it-talks-monitoring-wind-energy-production-from-scada-systems-with-splunk.pdf http://conf.splunk.com/files/2016/slides/how-splunk-can-provide-real-time-operational-insights-to-drive-performance-and-customer-excellence-in-a-call-center-environment.pdf http://conf.splunk.com/files/2016/slides/leveraging-splunk-analytics-for-business-intelligence-and-devops-api-activity-and-performance.pdf http://conf.splunk.com/files/2016/slides/from-it-troubleshooting-and-service-monitoring-to-predicting-student-achievement-an-operations-research-love-story.pdf http://conf.splunk.com/files/2016/slides/lesser-known-search-commands.pdf http://conf.splunk.com/files/2016/slides/behind-the-magnifying-glass-how-search-works.pdf http://conf.splunk.com/files/2016/slides/fields-indexed-tokens-and-you.pdf http://conf.splunk.com/files/2016/slides/its-10pm-do-you-know-where-your-data-is.pdf http://conf.splunk.com/files/2016/slides/architecting-splunk-for-high-availability-and-disaster-recovery.pdf http://conf.splunk.com/files/2016/slides/observations-and-recommendations-on-splunk-performance.pdf http://conf.splunk.com/files/2016/slides/shop-smart-at-the-kv-store-best-value-tricks-from-the-splunk-kv-store-and-rest-api.pdf http://conf.splunk.com/files/2016/slides/the-chargeback-app.pdf http://conf.splunk.com/files/2016/slides/splunking-your-zos-mainframe.pdf http://conf.splunk.com/files/2016/slides/quis-custodiet-ipsos-custodes-who-watches-the-watchmen-or-how-do-you-know-when-splunk-stops-searching.pdf http://conf.splunk.com/files/2016/slides/superspeeding-transaction-monitoring-with-the-kvtransaction-command.pdf http://conf.splunk.com/files/2016/slides/internet-of-big-rolling-things-at-db-cargos-european-rolling-stock-increased-customer-satisfaction-through-higher-availability-and-reliability.pdf http://conf.splunk.com/files/2016/slides/indexer-clustering-internals-scaling-and-performance.pdf http://conf.splunk.com/files/2016/slides/multi-tenant-architecture-securing-splunk-to-combat-snooping-users.pdf http://conf.splunk.com/files/2016/slides/dashboard-wizardry.pdf http://conf.splunk.com/files/2016/slides/whats-new-custom-visualizations.pdf http://conf.splunk.com/files/2016/slides/keeping-the-junk-out-of-splunk-maximizing-the-value-of-your-splunk-license-and-being-prepared-for-floods-of-data.pdf http://conf.splunk.com/files/2016/slides/solve-big-problems-with-machine-learning.pdf http://conf.splunk.com/files/2016/slides/search-optimization.pdf http://conf.splunk.com/files/2016/slides/splunk-and-open-source-integrations-with-spark-solr-hadoop-and-nosql-storage.pdf http://conf.splunk.com/files/2016/slides/confidence-in-conclusions-leveraging-splunk-for-data-driven-insights.pdf http://conf.splunk.com/files/2016/slides/predicting-incidents-with-supervised-and-unsupervised-machine-learning-on-splunk.pdf http://conf.splunk.com/files/2016/slides/scada-and-splunk-soul-mates-forever.pdf http://conf.splunk.com/files/2016/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf http://conf.splunk.com/files/2016/slides/splunk-app-lifecycle-management-with-more-peace-love-and-rock-n-roll.pdf http://conf.splunk.com/files/2016/slides/leveraging-splunks-ecosystem-for-your-own-products.pdf http://conf.splunk.com/files/2016/slides/step-up-your-app-dev-game.pdf http://conf.splunk.com/files/2016/slides/fast-time-to-extraordinary-value-quickly-add-powerful-machine-learning-to-your-splunk-apps-and-dashboards-with-splunks-new-machine-learning-toolkit.pdf http://conf.splunk.com/files/2016/slides/how-to-extend-splunk-with-an-ai-assistant-for-pattern-recognition.pdf http://conf.splunk.com/files/2016/slides/extending-splunks-rest-api-for-fun-and-profit.pdf http://conf.splunk.com/files/2016/slides/scaling-security-incident-investigations-with-interactive-event-graphs-and-spark.pdf http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.pdf http://conf.splunk.com/files/2016/slides/you-cant-protect-what-you-cant-see-aws-security-monitoring-and-compliance-validation-from-adobe.pdf http://conf.splunk.com/files/2016/slides/worst-practices-and-how-to-fix-them.pdf http://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-developing-splunk-apps-and-add-ons.pdf http://conf.splunk.com/files/2016/slides/jiffy-lube-quick-tune-up-for-your-splunk-environment.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-deploying-splunk-on-amazon-web-services.pdf http://conf.splunk.com/files/2016/slides/deploying-splunk-enterprise-on-microsoft-azure-cloud.pdf http://conf.splunk.com/files/2016/slides/building-a-crystal-ball-forecasting-future-values-for-multi-cyclic-time-series-metrics-in-splunk.pdf http://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-potential.pdf http://conf.splunk.com/files/2016/slides/integrating-with-third-party-tools-using-splunk-alert-actions.pdf http://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-entertainment.pdf http://conf.splunk.com/files/2016/slides/how-to-scale-from-raw-to-tstats.pdf http://conf.splunk.com/files/2016/slides/onboard-your-data-faster-using-the-splunk-add-on-builder.pdf http://conf.splunk.com/files/2016/slides/puppet-enterprise-and-splunk-platform-improve-your-application-delivery-velocity.pdf http://conf.splunk.com/files/2016/slides/the-impossibles-a-story-from-a-devops-team.pdf http://conf.splunk.com/files/2016/slides/biz-pmo-dev-qa-sec-build-stage-ops-biz-shared-metrics-as-a-forcing-function-for-end-to-end-enterprise-collaboration.pdf http://conf.splunk.com/files/2016/slides/splunks-of-war-creating-a-better-game-development-process-through-data-analytics.pdf http://conf.splunk.com/files/2016/slides/building-a-smarter-strategy-for-alarms-with-machine-learning.pdf http://conf.splunk.com/files/2016/slides/hunting-the-known-unknowns-the-powershell-edition.pdf http://conf.splunk.com/files/2016/slides/conquering-the-ids-alert-challenge-with-splunk.pdf http://conf.splunk.com/files/2016/slides/anomaly-hunting-with-splunk-software.pdf http://conf.splunk.com/files/2016/slides/splunking-the-endpoint-hands-on.pdf http://conf.splunk.com/files/2016/slides/detecting-the-adversary-post-compromise-with-threat-models-and-behavioral-analytics.pdf http://conf.splunk.com/files/2016/slides/autonomous-threat-hunting-with-niddel-and-splunk-enterprise-security-mars-inc-customer-case-study.pdf http://conf.splunk.com/files/2016/slides/forwarder-management-in-splunk-cloud.pdf http://conf.splunk.com/files/2016/slides/im-a-windows-girl-in-a-red-hat-world-reducing-the-splunk-learning-curve.pdf http://conf.splunk.com/files/2016/slides/show-the-board-the-value-of-your-incident-response-team-detect-a-live-attack-with-splunk-and-knock-their-socks-off.pdf http://conf.splunk.com/files/2016/slides/through-the-security-looking-glass-operationalizing-cloud-enterprise-security-an-adaptive-response-approach.pdf http://conf.splunk.com/files/2016/slides/exploring-the-frameworks-of-splunk-enterprise-security.pdf http://conf.splunk.com/files/2016/slides/powershell-power-hell-hunting-for-malicious-use-of-powershell-with-splunk.pdf http://conf.splunk.com/files/2016/slides/maturing-workdays-soc-with-splunk.pdf http://conf.splunk.com/files/2016/slides/speeding-up-incident-response-using-splunk.pdf http://conf.splunk.com/files/2016/slides/live-demonstration-bypassing-application-whitelisting-and-stealing-your-data.pdf http://conf.splunk.com/files/2016/slides/beyond-regular-regular-expressions.pdf http://conf.splunk.com/files/2016/slides/global-enterprise-security-without-security-analysts-yes-you-can.pdf http://conf.splunk.com/files/2016/slides/demystifying-machine-learning-and-anomaly-detection-practical-applications-in-splunk-for-insider-threat-detection-and-security-analytics.pdf http://conf.splunk.com/files/2016/slides/finding-straw-in-a-hay-field-the-art-of-devops-log-farming.pdf http://conf.splunk.com/files/2016/slides/data-driven-devops-using-splunk-software-and-ansible-tower.pdf http://conf.splunk.com/files/2016/slides/from-devops-to-bizops.pdf http://conf.splunk.com/files/2016/slides/how-to-use-splunk-to-detect-and-defeat-fraud-theft-and-abuse.pdf http://conf.splunk.com/files/2016/slides/how-to-use-splunk-for-automated-regulatory-compliance.pdf http://conf.splunk.com/files/2016/slides/building-the-pipeline-presented-by-csaa-insurance-group-featuring-devops-and-splunk.pdf http://conf.splunk.com/files/2016/slides/securing-splunk-with-proxy-sso-saml-and-multi-factor-authentication.pdf http://conf.splunk.com/files/2016/slides/rebalancing-data-across-an-indexer-cluster.pdf http://conf.splunk.com/files/2016/slides/enriching-your-data-using-the-latest-features-of-splunk-db-connect.pdf http://conf.splunk.com/files/2016/slides/tco-savings-through-storage-reduction.pdf http://conf.splunk.com/files/2016/slides/easing-into-clustering.pdf http://conf.splunk.com/files/2016/slides/time-after-time-comparing-time-ranges-in-splunk.pdf http://conf.splunk.com/files/2016/slides/anatomy-of-a-successful-splunk-it-service-intelligence-deployment.pdf http://conf.splunk.com/files/2016/slides/it-seemed-like-a-good-idea-at-the-time-architectural-anti-patterns.pdf http://conf.splunk.com/files/2016/slides/buckets-full-of-happy-tiers-scale-out-enterprise-infrastructure-and-splunk-apps-for-deploying-massive-and-efficient-splunk-environments.pdf http://conf.splunk.com/files/2016/slides/the-truthiness-of-wire-data-using-splunk-app-for-stream-for-performance-monitoring.pdf http://conf.splunk.com/files/2016/slides/how-to-run-splunk-as-a-docker-image.pdf http://conf.splunk.com/files/2016/slides/monitoring-and-troubleshooting-docker-across-cloud-and-on-prem-environments.pdf http://conf.splunk.com/files/2016/slides/splunk-it-service-intelligence-keep-your-boss-and-their-bosses-informed-and-happy-and-still-have-time-to-sleep-at-night.pdf http://conf.splunk.com/files/2016/slides/how-anaplan-used-splunk-cloud-and-itsi-to-monitor-its-cloud-platform.pdf http://conf.splunk.com/files/2016/slides/security-ninjutsu-part-three-real-world-correlation-searches.pdf http://conf.splunk.com/files/2016/slides/find-a-hay-in-haystack.pdf http://conf.splunk.com/files/2016/slides/splunk-gone-wild-innovating-a-large-splunk-solution-at-the-speed-of-management.pdf http://conf.splunk.com/files/2016/slides/how-md-anderson-cancer-center-uses-splunk-to-deliver-world-class-healthcare-when-patients-need-it-the-most.pdf http://conf.splunk.com/files/2016/slides/an-ongoing-mission-of-service-discovery.pdf http://conf.splunk.com/files/2016/slides/metrics-driven-devops-with-jenkins-and-splunk.pdf http://conf.splunk.com/files/2016/slides/advanced-machine-learning-in-spl-with-the-machine-learning-toolkit.pdf http://conf.splunk.com/files/2016/slides/unified-open-sourced-splunk-configuration-management-system.pdf http://conf.splunk.com/files/2016/slides/the-power-of-data-normalization-a-look-at-cim-under-the-hood.pdf http://conf.splunk.com/files/2016/slides/harnessing-performance-and-scalability-with-parallelization.pdf http://conf.splunk.com/files/2016/slides/splunking-your-mobile-apps.pdf http://conf.splunk.com/files/2016/slides/earn-a-seat-at-the-business-table-with-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/finding-your-faults-before-mom-deploying-splunk-for-it-troubleshooting-and-capacity-planning-on-large-scale-integrated-datacenter-infrastructure.pdf http://conf.splunk.com/files/2016/slides/writing-actionable-alerts.pdf http://conf.splunk.com/files/2016/slides/best-practices-and-better-practices-for-admins.pdf http://conf.splunk.com/files/2016/slides/splunking-azure-gain-insights-into-your-microsoft-azure-data-using-splunk.pdf http://conf.splunk.com/files/2016/slides/avoid-fines-and-save-money-automating-regulatory-compliance-with-qmulos.pdf http://conf.splunk.com/files/2016/slides/analytics-at-speed.pdf http://conf.splunk.com/files/2016/slides/splunk-performance-reloaded-best-practices-for-a-performant-splunk-deployment.pdf http://conf.splunk.com/files/2016/slides/power-of-spl.pdf http://conf.splunk.com/files/2016/slides/enterprise-security-multi-tenant-fundamentals.pdf http://conf.splunk.com/files/2016/slides/splunk-and-open-source-build-vs-buy-decisionmaking.pdf http://conf.splunk.com/files/2016/slides/bucket-diversity-choosing-your-search-mate-wisely.pdf http://conf.splunk.com/files/2016/slides/machine-learning-and-anomaly-detection-in-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/introduction-to-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/satellites-choropleth-maps-and-itsi-oh-my.pdf http://conf.splunk.com/files/2016/slides/a-very-brief-introduction-to-machine-learning-for-itoa.pdf http://conf.splunk.com/files/2016/slides/you-cannot-manage-what-you-dont-monitor-correlated-monitoring-of-an-enterprise-alm-environment-at-bosch.pdf http://conf.splunk.com/files/2016/slides/faster-time-to-value-with-itsi-modules.pdf http://conf.splunk.com/files/2016/slides/welcome-to-tomorrow-today-why-you-need-to-merge-it-and-security-in-todays-connected-world.pdf http://conf.splunk.com/files/2016/slides/from-30-minutes-to-40-seconds-applying-adaptive-response-to-automate-human-event-triage-with-splunk-es-and-phantom.pdf http://conf.splunk.com/files/2016/slides/splunk-cloud-a-peek-under-the-hood.pdf http://conf.splunk.com/files/2016/slides/infrastructure-analytics-driving-outcomes-through-practical-use-cases-and-applied-data-science-with-splunk-at-cisco.pdf http://conf.splunk.com/files/2016/slides/a-framework-for-developing-and-operationalizing-security-use-cases.pdf http://conf.splunk.com/files/2016/slides/increasing-engineering-productivity-in-micro-services-world.pdf http://conf.splunk.com/files/2016/slides/indexer-clustering-basics-internals-and-debugging.pdf http://conf.splunk.com/files/2016/slides/managing-a-large-scale-multi-site-distributed-deployment-without-going-insane.pdf http://conf.splunk.com/files/2016/slides/how-fast-is-fast-enough-improving-splunk-performance-with-batch-mode-search.pdf http://conf.splunk.com/files/2016/slides/real-world-role-based-access-controls-in-a-decentralized-environment.pdf http://conf.splunk.com/files/2016/slides/splunk-to-a-cure-be-inspired-by-a-lifesaving-use-case-of-managing-t1-diabetes.pdf http://conf.splunk.com/files/2016/slides/its-a-family-affair-splunk-and-the-art-of-home-iot.pdf http://conf.splunk.com/files/2016/slides/help-how-do-i-get-help-with-all-things-splunk.pdf http://conf.splunk.com/files/2016/slides/help-how-do-i-get-help-with-all-things-splunk.pdf http://conf.splunk.com/files/2016/slides/moving-from-data-to-wisdom.pdf http://conf.splunk.com/files/2016/slides/kick-start-a-cmdb-with-the-splunk-platform.pdf http://conf.splunk.com/files/2016/slides/the-10x-tool-splunk-development-force-multiplier-for-workday.pdf http://conf.splunk.com/files/2016/slides/proactive-oracle-database-monitoring-and-capacity-planning-with-splunk-software.pdf http://conf.splunk.com/files/2016/slides/splunk-and-control-systems-enabling-a-secure-iot-strategy.pdf http://conf.splunk.com/files/2016/slides/managing-day-to-day-operations-of-a-large-scale-splunk-deployment-cost-effectively.pdf http://conf.splunk.com/files/2016/slides/big-data-analytics-for-healthcare-decision-support-operational-clinical-and-fraud-waste-and-abuse.pdf http://conf.splunk.com/files/2016/slides/data-that-matters-a-devops-expert-panel.pdf http://conf.splunk.com/files/2016/slides/wrangling-your-iot-data-into-splunk.pdf http://conf.splunk.com/files/2016/slides/what-you-need-to-know-about-the-http-event-collector.pdf http://conf.splunk.com/files/2016/slides/whats-new-with-splunk-scheduler.pdf http://conf.splunk.com/files/2016/slides/your-splunk-sandbox.pdf http://conf.splunk.com/files/2016/slides/the-nosey-neighbor-challenge-physical-address-conversion-to-geolocation.pdf http://conf.splunk.com/files/2016/slides/dashboard-design-and-data-visualization-best-practices.pdf http://conf.splunk.com/files/2016/slides/next-generation-dashboards.pdf http://conf.splunk.com/files/2016/slides/splunk-for-google-analytics-how-to-gain-more-insight-into-site-performance-and-user-activity-by-correlating-google-analytics-data-within-splunk-software.pdf http://conf.splunk.com/files/2016/slides/customer-success-trends-best-practices-and-resources.pdf http://conf.splunk.com/files/2016/slides/lets-rebalance-data-across-an-indexer-cluster-in-15-minutes.pdf http://conf.splunk.com/files/2016/slides/tco-savings-through-storage-reduction-in-15-minutes.pdf http://conf.splunk.com/files/2016/slides/whats-new-enhanced-search-assistance.pdf http://conf.splunk.com/files/2016/slides/whats-new-with-data-analysis.pdf http://conf.splunk.com/files/2016/slides/replication-of-summary-data-in-indexer-cluster.pdf http://conf.splunk.com/files/2016/slides/lets-customize-those-visualizations.pdf http://conf.splunk.com/files/2016/slides/optimized-search-optimization.pdf ... View more

Hi, Can I point you to: https://splunk-sizing.appspot.com/ The compressed rawdata file is roughly 15% of the incoming , pre-indexed raw data. So based on that number you can apply the normal sizing. I don't think that encryption impacts performance in terms of CPU to x % higher..... ... View more

There are several settings that you need to configure before this works: Install the UF software on the server where you want to collect the data from and send it to the indexer. Configure the forwarder to connect to the indexer. The indexer listens on a receiving port for forwarded data. You also need to configure the receiving port (for example 9997) on the indexer first (one time only): The indexer listens on a receiving port for forwarded data. See--> http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Enableareceiver On the indexer: Settings->Forwarding & Receiving->Configure Receiving or in command line: splunk enable listen <9997> This is saved in the inputs.conf on the indexer [splunktcp://9997] Set up forwarding on the Universal Forwarder: Configure outputs.conf [tcpout:splunk_indexer] server = ipadress:9997 You can do this in command line: splunk add forward-server indexername:9997 ... View more

OK, I guess what you can do then is to go to Edit-->Convert to HTML. Or in 6.5 Edit-->Source And then wrap each panel in a borders using html / css. http://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/UseCSS ... View more

It seems that dashboard is made from 1 panel. I would break up the individual 4 searches into 4 separate panels. This is the quickest way to create borders I guess. For larger headers you could quickly create empty HTML Panels above each separate panel. Did you look at the course Advanced Dashboards and Visualizations with Splunk? ... View more