I manage a fairly large deployment of Splunk for a healthcare organization. We recently merged 3 separate deployments into a single larger deployment (nix, windows, and firewall). Both the nix and windows deployments are still on 5.0.5. The firewall team, who use ping federate, are already on 6.0. Additionally, our security group recently purchased a 2.5TB license and wants my groups assistance in managing their deployment and maintaining their infrastructure. We currently have over 300 active business users, running between 1000-3000 searches per day. All of these searches are powering 30 dashboards in advanced XML. With the addition of the security team's needs, we estimate searches being around 5,000 per day. I have been told that advanced XML is depreciated in 6.0. With so many business users being impacted if this is the case, I am hesitant to make the switch. I know that our current dashboards work fine in our QA environment with advanced XML. Is there something I am missing? From what I have read on the forums and the documentation I only see that advanced XML is impacted when using some of the new features in 6.0, such as the pivot table feature. Is this truly the case or have I missed something completely? Preferably, we would hire Splunk to come in and do an evaluation of this. There is just no funds for that sort of project until second quarter of next year at the earliest. The mandate given to me by leadership has been to upgrade by the end of November at the latest. ... View more

Apparently there is a limit to how many times someone can flag spam on the message boards, 5 based on the message I am getting. I assume there is a good reason for this or else it wouldn't be there. Over the past few days there has been an abundance of Spam regarding NFL games for streaming. Can one of the mods take care of these? ... View more