how can we get the oldest index time of an index ? Does retention policy depend on indextime or _time ? ... View more

Hi, For installing the Machine Learning Toolkit on a search head cluster, are there any impacts on the performance of the cluster. Is it necessary to install the addon on the indexer cluster as well. ... View more

Hi there, I wanted to create an alert which keeps on running every hour and checks the data from starting of the day and till now and if the count is greater than a value, it should generate an alert and no alert for the rest of the day. I have used the following parameters. But it does not seem to be right because if we get an alert at 6pm today we don't get another alert until 6pm the next day. what if the count has exceeded the limit at some time less than 6pm the next day we would not get an alert because of the throttle. If we don't use throttle we get overlapping of the results. Alert type :Scheduled Run on Cron Schedule Earliest: @d Latest: now Cron Expression: */60 * * * * **Trigger Conditions** Trigger alert when Number of Results is greater than 0 Trigger Once For each result Throttle? Suppress triggering for 1 day(s) Please recommend a solution . Urgent. Thanks for the help ... View more

A host was already sending data using an outputs.conf file . Another outputs.conf was added with out knowing which is linked to some other indexers. So what happens here ? Will it send the same to both groups or use the latest one or only the old one ? ... View more

index=* | stats values(source),values(sourcetype),count(sourcetype) by host ....query i used host values(source) values(sourcetype) count(sourcetype) xyz WinAuthentication_Security.log test 54971 sysmonitor.log test2 The value 54971 is the combined value of all both the sourceype . I want that total to be split accordingly. something like this: host values(source) values(sourcetype) count(sourcetype) xyz WinAuthentication_Security.log test 4000 sysmonitor.log test2 1971 Can you please suggest. ... View more