Hello there, couple of things you can do right away are: disable DM accelerations for indexes that dont contain any data / enable only relevant DMs and map to the right index follow this document to manage as you see fit (many links to possible tweaks) https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Managingcontent hope it helps ... View more

as a rule of thumb, apps that require setup are first to be set up on the Deployer (or any other instance), then copy the relevant directory (app) to the shcluster/apps directory and push from there. ... View more

hello there, there are many ways to do it in Splunk. couple of commands to consider: streamstats, detla, trendline, autoregress, accumn look here for example: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Trendline As there are many other ways to do this, here is a very simplified version of what i understand you are trying to achieve: | gentimes start=-1 increment=1m | head 10 | eval _time = starttime | table _time | eval v1 = random()%10 | eval v2 = random()%10 | eval v3 = random()%10 | rename COMMENT as "the above generates data below is the solution" | delta v1 as dv1 | delta v2 as dv2 | delta v3 as dv3 | eval alert = if(dv1 > 0 AND dv2 < 0 AND dv3 < 0,"ALERT","OK") hope it helps ... View more

you have to define the volumes in indexes.conf my guess is that this is volume locations: /dev/sdb1 8.7T 84M 8.7T 1% /splunkdata/hot /dev/sda1 31T 20K 31T 1% /splunkdata/cold here is an example from docs: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/indexesconf#indexes.conf.example volume definitions; prefixed with "volume:" [volume:hot1] path = /mnt/fast_disk maxVolumeDataSizeMB = 100000 [volume:cold1] path = /mnt/big_disk # maxVolumeDataSizeMB not specified: no data size limitation on top of the # existing ones [volume:cold2] path = /mnt/big_disk2 maxVolumeDataSizeMB = 1000000 ... View more

hello there, here is a clumsy solution, try the following search anywhere. I bet there are better ways, its just been a very long day 🙂 | makeresults count=1 | eval data="A 1 5 10;;;B 2 11 8;;;C 3 23 4;;;D 91 2 21;;;E 7 1 200;;;F 74 22 11" | makemv delim=";;;" data | mvexpand data | rex field=data "(?<device>[^\s]+)\s(?<k1>[^\s]+)\s(?<k2>[^\s]+)\s(?<k3>[^\s]+)" | table device k* | rename COMMENT as "the above generates data below is the solution" | eval no_op = " " | xyseries no_op device k1 k2 k3 | transpose | rename column as base "row 1" as values | rex field=base "(?<key>[^\:]+)\:\s+(?<device>.*+)" | eventstats max(values) as max_values by key | where max_values = values hope it helps ... View more

bring the PKI software data to splunk alert on expiring keys automate keys replacement if you wish ... seen it done many times ... View more