Here is what I have, although the result is not formatted as I would like... I assumed the field names are user and ip for the data that you need. "Login succeeded" | stats values(ip) as Failed_Login_IPs by user | join user type=outer [search "Login failure" | stats values(ip) as Successful_Login_IPs by user ] This is not fast, although the speed may be okay if you keep the time range relatively small. ... View more

There is no app for Lotus Notes. I don't know what is typical for Lotus Notes admins to monitor, but Splunk can monitor any text file. I think there is an option in Lotus Notes to log to a database (.nsf) or to a text file. I recommend that you log to text -- and rotate logs often. Splunk will track log rotation properly, so rotate your logs frequently and archive (or delete) older logs to save disk space and keep things tidy. You can simply ask Splunk to monitor the directories where the message logs, error logs and/or web access logs are written. At a minimum, I think you will want to monitor the diagnostic logs. Remember that XML files are text too, so you can simply monitor XML files with Splunk the same way you monitor other text files. I also suggest that FIRST you test out these inputs on a test copy of Splunk - don't add the Lotus Notes events into your production system until you see exactly what is flowing into Splunk. Once you look at the data, you can decide if you need to tweak Splunk's settings to make it work better for you. If you need help tweaking Splunk, open up a new question in this forum. It helps if you paste in a sample of your log file. Lots of folks here can help you, even if we don't know much about Lotus Notes, if we can see the format of the files that you want to Splunk. ... View more

I think you are hitting the limit of Splunk's chart resolution. I don't think there is any way to do this in Splunk. The underlying technology in the current release (4.2.4), and earlier, is Flash. But perhaps someone else will have a brilliant solution... ... View more

Splunk can definitely use all the resources of the box. It is high-performance multi-threaded code, I would not virtualize the box; this will not help Splunk use it better. The overhead of virtualization will not be offset by any performance improvements. (I am a VMware-certified VCP4, if that helps my credibility on this one.) Think of the Splunk advice as "Spend your money on lots of average-sized servers, rather than a few giant servers." Why? average-sized "commodity" servers are relatively cheap. When you start buying "extra large" memory, etc., it tends to come at a premium price. So "commodity" servers are the most effective way to spend the money. (But your servers were free!) more boxes gives you more concurrent IO - for Splunk indexers, IO is usually the bottleneck Splunk is designed to be distributed; adding more indexers increases search performance nearly linearly Lucky you - I wish someone would give me some physical servers (that weren't ready for the junk heap)! I would probably make them all indexers, unless my search head was overloaded. Adding indexers = reduced search time = more searches per minute = can serve more users effectively. ... View more