I want a $total$ variable in a dashboard to apply to a label of one of my panels. I want it to just say (loading..) while the search loads, and then only switch to the number once the search that assigns the token completes. I init the variable to the loading value <init> <set token="total">(loading...)</set> </init> And then, I set the variable when a search is supposed to be done <search> <query> blah blah blah a search that outputs one row, which is a stats output for a total</query> <done> <condition match="'job.resultCount'!=0"> <set token="total">$result.Total$</set> </condition> </done> </search> And then, I write in to one of my labels to display $total$ Basically what happens, is that the (loading...) text displays only for a short while, and instead, it quickly just pops up the "$result.Total$" text for a long while, while the search loads, and even far after the search should be completed by. It isn't until a good amount of time later that the number actually populates. Other variants I've tried are to use finalized instead of done, and also to not do the condition check. Every single one produces roughly the same behavior. How am I suppose to actually prevent the $result.Total$ text from being displayed? I Only want to assign that token value when the search is done. Apparently "done" isn't done in this case. Is there something I'm missing here? ... View more

We use 12 indexers in a cluster. They have the same exact hardware and install dates on all of them. However, there are 3 particular indexers that look to degrade at nearly 3 times the rate of the rest of them. I'm wondering what some possibilities could be for this? Or if anyone else has ever ran into something similar? This is hardware wear out on the hard drives specifically. ... View more

After I perform a search and click the "Format" Icon above the search results, there is an option for "Wrap Results". I check this and it does an attempt at wrapping results, but I still have to scroll incredibly far to the right to see each result. It seems to just pick some arbitrary length and wraps it there. I should note, in the events there are plenty of spaces that could be used as clean wrap points but the system just seems to not use them. Is there some sort of config setting that controls wrap behavior that I could tweak? This is Splunk 7 I'm on as well. ... View more

I have a csv I ingest where I just want it to default to the date of last modified for the csv... there are no actual timestamp columns in this csv, however splunk keeps automatically trying to treat some of the longer integer values as epochs, causing several rows to just get thrown out because they are detected as being decades in the past. Is there anyway I can turn this feature off per sourcetype? ... View more

repFactor = auto homePath = volume:home/indexname/db coldPath = volume:SAN/indexname/colddb thawedPath = $SPLUNK_THAW_VOL/indexname/thaweddb # the max settings are copied from main's default max settings maxMemMB = 20 maxConcurrentOptimizes = 6 maxHotIdleSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume homePath.maxDataSizeMB = 409600 coldPath.maxDataSizeMB = 1536000 maxTotalDataSizeMB = 1945600 # maxTotalDataSizeMB = ? # keep logs for 90 days frozenTimePeriodInSecs = 7776000 The logs seem to be rolling from cold to frozen at around 60 days, all but one or two source types (so when I search back to between 60 and 90 days I only see one or two sourcetypes when there should exist over 20). The coldpath limit isn't even close to being hit on this index. I implemented this index configuration at the beginning of the year so it should be keeping the data for 90 day periods, yet it's throwing them out before. Are there other areas that can trigger a rolling from cold to frozen? We have plenty of space on the drives as well. ... View more