Hello All, I am facing an issue with the summary indexing, always the data in the summary index is limited to 50000 events but when i run the query manually i get more than them actually doubt the above count. I have verified the size of my summary index and dispatch.max_count value and both are more to accept the acutal numbers. But events are getting trimmed to 50000 in summary index. I have checked both verbose and fast mode. Kindly help me out in where i need to check?? Regards, BK ... View more

<form> <label>Dates test</label> <fieldset submitButton="false"> <input type="radio" token="selection"> <label> Select a value</label> <choice value="Quarter">Quarter</choice> <choice value="Month">Month</choice> <choice value="Week">Week</choice> <default>Month</default> <change> <condition value="Month"> <set token="show_category1">true</set> </condition> <condition> <unset token="show_category"></unset> </condition> </change> <change> <condition value="Quarter"> <set token="show_category">true</set> </condition> <condition> <unset token="show_category1"></unset> </condition> </change> </input> <input type="dropdown" token="Quarter" depends="$show_category$"> <label> Select </label> <choice value="Q1">Q1</choice> <choice value="Q2">Q2</choice> <choice value="Q3">Q3</choice> <choice value="Q4">Q4</choice> <default>Q1</default> </input> <input type="dropdown" token="Month" depends="$show_category1$"> <label> Select $Month$</label> <choice value="Q1">Jan</choice> <choice value="Q2">Feb</choice> <choice value="Q3">Mar</choice> <choice value="Q4">Apr</choice> <default>Jan</default> </input> </fieldset> </form> Drop down need to be shown based on the radio button selection, button it is not working out to me...kindly help me out where i am wrong? Regards, BK ... View more

Hello All, I have to provide two where conditions in my query and need to count the events by individual counts and sum them up..Below is the example Where x>y AND y>z -- need to calculate count Where z>a -- need to calculate count end i need to do sum of both above counts. kindly provide some inputs on the same. Regards, BK ... View more

Hello All, We have two indexes, old one is ABC and new one is DEF, ABC has ~100GB data, we wanted to move the data to DEF. Can we copy ABC buckets and pasted under DEF index?? If so, will it consume additional license for DEF as well?? Is it recommended to do such a copy if needed?? Help in this regard is highly appreciated. Thanks in advance! BK ... View more

Hi All, We wanted to move data from one index to another index, below is our scenario: 1) Create a new index ABC and move specific source data to this index from old index DEF. 2) Delete the moved sourced data from old index DEF using | delete command. As we know that using delete option data will not be deleted but be made non-searchable, so in our case disk usage will be both from ABC source index and DEF source index?? So for example source content size is 10GB we need 20GB on the disk to hold both ABC and DEF sources?? Is there any other option to get rid of using extra data usage on the disk?? If we use |collect command will it share the data equally to all the indexers that are available in our environment? Help in this regard is highly helpful. Thanks in advance! Regards, BK ... View more