Data retention and access and how sensitive is the data will determine how you will classify and store it. Different approaches for diff organisations. Few of the methods have already been listed by @inventsekar and @isoutamo . ... View more

https://community.splunk.com/t5/Monitoring-Splunk/Restore-archived-data/m-p/76301   if this does not help open case with support. ... View more

Did you manually move tsidx files??   ... View more

i see you have customized inputs : this is thedefault one ## Network [perfmon://Network] counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size disabled = 1 instances = * interval = 10 mode = multikv object = Network Interface useEnglishOnly=true   you have customized sourcetype. I will not do that, as there is a lot more working on standard sourcetype in a addon behind the scenes during indexing time. ... View more

index time field extractions and mappings are all done in props and transforms.conf. ... View more

yes  ... View more

I have the powershell script to remotely install the forwarder and the copy splunk ta windows to to apps directory I can send it over tomorrow. ... View more

Reports and searches are in savedsearches.conf just copy that saved searches.conf to local directory in ES. Hope that helps ... View more

index = your index |table host, source, sourcetype, event_id,  message, type the fields you need here  This will give you all the info and save this search as dashboard for windows event logs and that should do...  Metrics (cpu,mem,disk)is totally diff story and will need more info before a query can be written.       ... View more

Index = * | search "Request Number"=0 ... View more

Please post some test data to test the query if its not sensitive data. ... View more

Results   ... View more

|makeresults |eval stage= "Capa Capa_india north_Capa checkcapaend NET net_east" |makemv stage |mvexpand stage |eval stage=lower(stage) |fields - _time |eval stagename = if(match(stage,"capa"),1,2) |chart count by stage stagename   try that if that helps.. ... View more

check this post might be of help.   https://community.splunk.com/t5/Splunk-Search/How-to-change-bar-chart-color-based-on-its-value/m-p/549567#M155944 ... View more

you can do that in statistical table easy. ... View more

normally sourcetype is defined in inputs. and it should auto populate in search.  ... View more

Will need more info, what sourcetype you are using. As there may be a addon which can do field extractions needed here. ... View more

|rest /services/data/indexes/|fields title maxTotalDataSizeMB currentDBSizeMB |eval indexStatus = if(currentDBSizeMB>1, "Data", "Empty") ... View more

|rest /services/data/indexes/|table title maxTotalDataSizeMB currentDBSizeMB    this will show all indexes and allocated size and used size. let me know if this works for you and if you need help modifying search. ... View more

index=* |stats count by index should do the trick. ... View more

(sourcetype=winevents OR sourcetype=vpn)| top limit=5  ... View more

Its fixed. it was an issue with inputs on forwarders. ... View more

| inputlookup <your>.csv|search OUI= field value. ... View more

| table .....| search state!=Listen ... View more