Looking to expire some really old 2005-2006 data in some of our older buckets with wide bucket spans, some stretch from earliest date-2011 to oldest 2006. This index is taking up a few terrabytes of cold storage and i would like to reduce it In the past i recall we cannot expire buckets if the earliest events are within the frozenTimePeriodInSecs value, is there a way to just delete the old events? here's the bucket examples drwx--x--x 4 root root 2048 Oct 5 2011 db_1316171253_1151333680_1591 drwx--x--x 4 root root 2048 Oct 5 2011 db_1316186570_1148764640_1593 drwx--x--x 4 root root 1024 Oct 5 2011 db_1316187080_1163161371_1585 drwx--x--x 4 root root 1024 Oct 5 2011 db_1316215973_1146088931_1595 drwx--x--x 4 root root 1024 Oct 5 2011 db_1316217599_1149873438_1587 drwx--x--x 4 root root 1024 Oct 5 2011 db_1316261550_1143637536_1597 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316262900_1147121232_1596 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316275823_1144749944_1594 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316283607_1143766728_1598 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316303999_1143409080_1592 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316317510_1143947712_1599 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316351098_1143646976_1600 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316370771_1144292776_1601 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316423496_1143689504_1603 drwx--x--x 4 root root 1024 Oct 6 2011 db_1316437356_1144262888_1604 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316512974_1146488376_1609 drwx--x--x 3 root root 1024 Oct 7 2011 db_1314489599_1272192960_1719 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316523360_1144554816_1608 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316563199_1143628240_1602 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316563199_1144056216_1605 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316563199_1146463960_1606 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316563199_1145669992_1607 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316581963_1144563144_1613 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316600608_1144622992_1614 drwx--x--x 4 root root 2048 Oct 7 2011 db_1316614176_1146094296_1615 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316627896_1145345824_1616 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316649599_1144204064_1610 drwx--x--x 4 root root 1024 Oct 7 2011 db_1316649599_1150239440_1611 drwx--x--x 4 root root 1024 Oct 8 2011 db_1316649599_1143870472_1612 drwx--x--x 4 root root 1024 Oct 8 2011 db_1316676544_1143990200_1618 drwx--x--x 4 root root 1024 Oct 8 2011 db_1316696944_1144613920_1619 drwx--x--x 4 root root 1024 Oct 8 2011 db_1316707239_1146104336_1620 ... View more

I've got the GeoASN application installed in our distributed environment(4 indexers so far 1 search head) running the script seems to be generating the generic red error bar saying "results may be incorrect" Search used: index=www sourcetype=access_combined splunk_server="splunk*-d*" | lookup ga ip AS clientip | stats count by country, org error is as follows Script for lookup table 'ga' returned error code 1. Results may be incorrect How do we go about troubleshooting this and resolving the error? I am checking python.log web_access and web_service so far nothing pops out as to what the problem is. basically want to either resolve or in the meantime squelsh the error until we can resolve it. ... View more

Hello Currently we have a Network operations dashboard that displays charted logs from routers/switches/firewalls syslog messages, we use this as our primary network alert dashboard. We are using a python script with a few hundred lines of regex strings to basically scrape over all incoming log alerts from our "net" index and only display log events NOT matching these filters. So one of our searches is as follows, the "netcritical" is our python script that is streaming log events to filter out from Splunk results. index=net | netcritical | search netcritical=true | timechart limit=0 useother=f c by host | rename c as "Alert Count" In this way we see any legitimate alerts and new alerts from various devices that we were not looking for but filter out logs that are noisy/we dont care about. It's worked well in our environment so far but it's not scaling well as we increase the amount of network devices writing to syslog. Our dashboard is taking a long time to load as it's parsing far too many logs. Can anyone offer some suggestions on the best way to replace this filter? We want to keep everything in the same "net" for log consistency but looking for alternate solutions within Splunk. ... View more