You are probably looking at the Compressed index size. Your data will be between 10% and 110% based on the data compression ratio and unique columns in the data.. I recommend installing S.O.S. (splunk on splunk) app http://apps.splunk.com/app/748/, it will give you much insight to these values (metrics dashboard i believe) ... View more

you could say earliest= http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Specifytimemodifiersinyoursearch Here's a post on that as well: http://answers.splunk.com/answers/57684/limit-how-far-back-you-can-retrieve-data-regardless-of-timerangepicker-selection ... View more

Indexes you can select farther down the form Here is an example of restricting to 2 sourcetypes "sourcetype=mySourceType OR sourcetype=myothersourcetype" Here is a post with someone having a similar request: http://answers.splunk.com/answers/75912/restrict-search-terms-conditionally-depending-on-the-index-being-searched ... View more

Try this: SELECT table_name as name, table_rows as rows FROM information_schema.tables where table_name like 'smpp_queue%' or table_name like 'smppmessagedetailstemp%' and table_rows > 10 ... View more

finally have the power to convert to answer 🙂 Thanks for your help martin. ... View more

index="ht-prod" host=htos sourcetype="ht/prod/htons/opt" OR sourcetype="ht/stge/htons/opt" | stats count by sourcetype | appendpipe [ stats count | where count==0] Try something like this ... View more

may also have to do something like this to return "something" when there are no results: http://answers.splunk.com/answers/78124/No-results-found,-I-want-to-show-other-message%EF%BC%81%EF%BC%81%EF%BC%81 ... View more

guess this only works if your search returns one event ... View more

Unfortunately they do not have much extensibility within the out of the box google maps. It would require you to implement your own custom map: http://answers.splunk.com/answers/117658/google-map-view-event-click ... View more

you may be able to lower resources by only allowing a certain amount of traffic through: http://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder ... View more

Unfortunately the only way to do this would be to implement your own : http://answers.splunk.com/answers/117658/google-map-view-event-click ... View more

Simply provides a standard method of parsing, categorizing, and normalizing data. http://docs.splunk.com/Documentation/CIM/latest/User/Overview The add-on is meant as an add-on, not an app. It is not meant to have a UI. It's pretty powerful to display all your data into common formats. You can then create dashboards with those standard fields without having to re-invent the wheel every time. There are several "CIM" compliant addons within the splunk apps and addons that some have already formatted popular logs into this format for you: http://apps.splunk.com/apps/#/search/CIM%20compliant http://apps.splunk.com/apps/#/search/Common%20Information%20Model http://apps.splunk.com/apps/#/search/CIMifies ... View more

If your issue is that you have too many violations of the warnings due to indexing too much data over time, you could always re-install splunk and they will dissapear ... View more

thanks! yes we will be doing virtualized. ... View more

What kind of database is it? ... View more

Since you did technically answer my question correctly 🙂 I did not phrase it correctly. I mean't to view windows security events that could possibly be malware.. not specifically malware events.. Thanks! ... View more

what is showing up? "$vikas$"? ... View more

in that case, apparently it is included with sideviewutils http://answers.splunk.com/answers/13393/how-to-create-multiselect-drop-down-field ... View more

For multi selections, You can use the http://docs.splunk.com/Documentation/WebFramework "MultiDropdownView" ... View more