Overall rank 650 now 😃 ... View more

You can use any boolean eval expression inside mvfilter() , including regex match() . ... View more

Use mvfilter(lower(Message) = "eng") , or some other filter to detect English. ... View more

You can add a | sort hours , which should use a more natural sorting order than stats . ... View more

I wouldn't say "don't use transaction", I'd say "use transaction for appropriate cases with smart settings". The docs flowchart you linked to covers some of this. In addition to the flowchart, if you have a very high cardinality ID with very short durations a transaction ID startswith=something will be faster than a stats by ID because transaction can discard completed IDs from memory while stats has to keep all of them in memory indefinitely. I also wouldn't say "don't use join", I'd say "use join for appropriate cases". The answers link I posted covers a lot of this. There are cases where join is the right answer, for example you have a complex search that gets some additional fields from a fast tstats. Trying to merge the two into one OR-stats-search often is counterproductive, and a pattern of search | complex stuff | stats | join [tstats] can be the best solution. In short, it depends. ... View more

I'd say using automatic lookups is good practice. avoids duplication of SPL when the lookup is used in multiple searches reduces the knowledge a searcher needs to have, they can just look at the events and see the output fields instead of having to know about the lookup file usually no negative performance impact ... View more

https://conf.splunk.com/watch/conf-online.html?search=worst# has a list of things... but not really focussed on SPL. https://conf.splunk.com/watch/conf-online.html?search=fn1003# has filtering bad practices and how to avoid them. https://conf.splunk.com/session/2015/conf2015_MMueller_Consist_Deploying_OptimizingSplunkKnowledge.pdf has knowledge objects / CIM normalization bad practices and how to avoid them. [side note, recent versions aren't as bad as it used to be] On the topic of event correlation there's also this: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html Can you tell me what's wrong with this way of using it? Wrong with what way in particular? ... View more

Is there a sample or a template search and alert available in official Splunk documentation that I could easily integrate into my environment? (Focus on "easily" - so that someone else in my team not intimately familiar with Splunk could do that?) No such template? Rethink your answer then? I'm not engaging in hostile back-and-forth on my free time. I don't work for Splunk, I don't get paid for answering stuff here. Rethink your tone? ... View more

There is no need to have individual alerts for different volumes, NAS volumes, SAN volumes, etc. - merge them all into one. Use lookups if you need different static thresholds. Set sane timeranges. Use _index_earliest if you need to look at data from a "when it arrived" point of view instead of the usual splunky "when it happened" point of view. For your question of (Is it even possible?) , sure. Splunk can run lots of complex searches, so there's no reason for your simple alerts to bring your cluster to its knees. If you need more specific advice then be more specific about what in particular you're doing that breaks in your environment. ... View more

Additionally, what does your collections.conf look like, especially accelerated fields for this collection? ... View more

span is used for commands like timechart. For your search, set the timerange using @w6 to refer to the most recent Saturday. ... View more

What is your SPL? ... View more

To search using week boundaries starting on Saturday use @w6 instead of @w . To chart using weekly spans starting on Saturday use span=1w@w6 instead of span=1w ... View more

| dbinspect can show you how many buckets there are, and what state they are in. ... View more

Yes on the pipelines, yes but per index on the hot buckets. ... View more

This should only tell you about indexes created via API / UI, not about indexes created via conf files (most common case in real-world environments with a separate indexing tier). Those don't have an easily accessible creation date. ... View more

If you store the hosts inside the macro you only need to list them out once, over all searches that require this particular list. ... View more

Use the Multiselect input type instead of the Dropdown input type. ... View more

The concept you're looking for is called macros. In the UI, go to Settings -> Advanced Search -> Search Macros to create one, remember to set sharing to App, and refer to the macro in your search using backticks. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros ... View more

The switch to the new team is mostly complete 🙂 ... View more