Hi ddrillic, there must be some misunderstanding here; the usage is not related if users are searching these indexes, it is related to size (eq disk/space usage) of the index. If you look at the search you will get a better understanding: | rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes datatype=all | join title splunk_server type=outer [rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes-extended datatype=all] | `dmc_exclude_indexes` | eval elapsedTime = now() - strptime(minTime,"%Y-%m-%dT%H:%M:%S%z") | eval dataAge = ceiling(elapsedTime / 86400) | eval indexSizeGB = if(currentDBSizeMB >= 1 AND totalEventCount >=1, currentDBSizeMB/1024, null()) | eval maxSizeGB = maxTotalDataSizeMB / 1024 | eval sizeUsagePerc = indexSizeGB / maxSizeGB * 100 | stats dc(splunk_server) AS Instances count(indexSizeGB) as "Non-Empty Instances" sum(indexSizeGB) AS totalSize avg(indexSizeGB) as averageSize avg(sizeUsagePerc) as averageSizePerc perc90(sizeUsagePerc) as ninetyPercentileSizePerc count(eval(sizeUsagePerc > 95)) as instancesFreezingDueToSize median(dataAge) as medianDataAge max(dataAge) as oldestDataAge count(eval(elapsedTime > frozenTimePeriodInSecs)) as instancesFreezingDueToAge sum(frozenTimePeriodInSecs) as infiniteFreezingFlag by title, datatype Hope this helps to understand the meaning. If not post a feedback on the docs page as woodcock mentioned. cheers, MuS ... View more

Hi panharry, First of all, please don't change datetime.xml . There are two options for you to get this timestamp either by using props.conf to set the timestamp at parsing time or by using rex to get it by search time. To do it at index/paring time you need to configure a props.conf for the sourcetype and options like this: [yourSourceTypeNameHereToMatch] TIME_FORMAT = %s%9N This will try to match your 17 digits as timestamp in _raw , you might need to add a TIME_PREFIX and/or increase the MAX_TIMESTAMP_LOOKAHEAD options as well to get to the timestamp in the event. Please read the docs about props.conf on this. For the search time example, please refer to this example: | makeresults | eval myTime="15613916758394847", myNewTime=strptime(myTime, "%s%9N"), myNewTime2=strftime(myNewTime, "%Y-%m-%d %H:%M:%S.%9N") the first line just creates a dummy event, the next line creates the sample timestamp and parses it into myNewTime as epoch. myNewTime2 is the human readable version of myNewTime . Hope this helps ... cheers, MuS ... View more

Hi morethanyell, put your config in this directory: $SPLUNK_HOME/etc/master-apps/_cluster/local Read more about it here https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#On_the_master This will still be in slave-apps on the peers but has the highest precedence. I'm not aware of any Splunk configuration method for an index cluster that will put configs from etc/master_apps into etc/apps . Hope this helps ... cheers, MuS ... View more

Hi ahmedragy922, if you look here https://splunkbase.splunk.com/app/3435/#/details you can find all the information you are looking for in very detailed listings. It also includes a link to a video. Hope this helps ... cheers, MuS ... View more

Hi ahmadsaadwarraich, reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true local = [true|false] * If true, specifies that the command should be run on the search head only * Defaults to false If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw. Hope this helps ... cheers, MuS ... View more

Hi ahmadsaadwarraich, the index name and sourcetype stash indicated that your source is a scheduled saved search, use this search to find the saved search: | rest /services/saved/searches | search auto_summarize=1 | table title eai:acl.app Title is the name of the saved search and eat:acl.app the name of the app where the search is saved. Hope this helps ... cheers, MuS ... View more

hi swangertyler, based on the provided examples give this a try: | makeresults | eval message="Please retire the following nodes(s): hostname1 node_id: \"text I dont need\" hostname2 node_id: \"text I dont need\" hostname3 node_id: \"text I dont need\" . . . hostnameN node_id: \"text I dont need\" Property: \"text I dont need\"" | rex field=message max_match=0 "(?<hostname>\w+)\snode_id" Hope this helps ... cheers, MuS ... View more

hi splunkitsipoc, usually you should be able to find it at /opt/splunk/etc/apps/ but it depends if Splunk was actually installed in /opt . Login as the user that runs Splunk and if you are lucky enough, this user has the Splunk environments variables setup, then you can just do a cd $SPLUNK_HOME/etc/apps and you will be in the right directory. If that does not work try running this command find / -type d -name splunk to find the location of the installed Splunk. Hope this helps ... cheers, MuS ... View more