Hello Yes, if the scheduled search to summarize the data is not executed, you will get gaps. Those gaps can be filled running the backfill command: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managesummaryindexgapsandoverlaps Did you tried report acceleration? It does something simmilar but without need of managing the gaps. Regards ... View more

Hello Maybe this is happening to your second indexer: Important: Universal forwarders are not able to switch indexers when monitoring TCP network streams of data (including Syslog) unless an EOF is reached or an indexer goes down, at which point the forwarder will switch to the next indexer in the list. Because the universal forwarder does not parse the data and identify event boundaries before forwarding the data to the indexer (unlike a heavy forwarder), it has no way of knowing when it's safe to switch to the next indexer unless it receives an EOF. From docs: http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd Check the type of data the 2nd indexer is receiving to see if this is your case Regards ... View more

Hello We are running a cluster with 2 peers, 1 master, and 1 SH, all physical servers (32gb ram and 24 cpu cores each), on Linux x64. We found that its related to the concurrent users (not concurrent searches). Restarting just splunkweb process fix the issue. Also we found this: The web.conf docs says this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Webconf # # cherrypy HTTP server config # server.thread_pool = <integer> * Specifies the minimum number of threads the appserver is allowed to maintain * Defaults to 50 server.thread_pool_max = <integer> * Specifies the maximum number of threads the appserver is allowed to maintain * Defaults to -1 (unlimited) server.thread_pool_min_spare = <integer> * Specifies the minimum number of spare threads the appserver keeps idle * Defaults to 15 server.thread_pool_max_spare = <integer> * Specifies the maximum number of spare threads the appserver keeps idle * Defaults to 30 But our default default web.conf file has only 3 of these settings, and all of them are commented out. We checked with btool and these settings are not being defined by any app. So the documentation doesn't match with the default splunk configuration... Maybe the issue is related to this... Regards ... View more

Hello We are facing exactly this very same issue, but with physical servers. Also we are running 5.0.2. Did you find the root of the problem? Any solution provided? thanks ... View more

Hello I think you are looking for this: earliest=-1d@d+1h latest=-1d@d+2h This will give you: yesterday between 1 AM and 2 AM, if you change the values of the +1h and +2h you can select any given hour range from yesterday Regards ... View more

Hello Try this regex: \w\:\\users\\\d+(?<yourfield>\\[^\r]*)$ Maybe you need to substitute the \r of the end of the rex by \n or \R Regards ... View more

then use this: (?i) \w+ (?P<FIELDNAME>[^ ]+) There is a "\" before the w+ ... View more

Sure you can: http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutcustomsearchcommands Regards ... View more

Hello I think, that what you want to achieve can not be done. All the peers in the cluster will index data from the forwarders and that data will go directly into hot buckets Regards ... View more

Hello Would be more like the second option. As the data arrives, it is compressed, and then rolls to the other buckets states with the same compression rate. regards ... View more

Hello All the buckets types (hot, warm, cold) should have the same compression ratio. As when the data is indexed, the index itself should be around 35% of the original data and the compressed data an additional 15%, that sums 50%. And this applies to any kind of bucket. Regards ... View more

Hello Probably you need to remove the domain part from the referrer field, as the uri doesn't include that part. Lets say: uri: /example/page.html referrer: http://www.example.com/example/page.html Regards ... View more

Hello, Splunk 6 has been released, and there is no UF for mainframe. Do you know if it is going to be released later this year? Thanks ... View more

Have you tried this? search NOT myfield="-" |.... Regards ... View more

Great! Thanks a lot! ... View more

Hello You can get this by several ways, but i think that the best performance would be something like: sourcetype="A" OR sourcetype="B" | stats values(statusB), values(statusA) by clientip, uri_path Other way would be using the join command, but i think it is worse from a performance point of view Regards ... View more

Hello Did you verified that the firewall ports are open? It seems to be a connectivity problem Try to do a telnet from the fw to the indexer, from the command line: telnet indexer 9997 Regards ... View more

Hello You only need the 3306, as long as you don't install a forwarder in the db server. regards ... View more