Replication is the process of moving the search-time configuration from the search head to the indexers. This is usually very fast, but can take some time if the indexers are across a WAN or if the apps on the search head are particularly large. We've made some improvements in 4.1.5 to make replication faster, but it can still be slow for large apps. If you are on an intranet, you can make it faster by adding to server.conf : [sslConfig] useSplunkdClientSSLCompression = false Or you could even disable SSL entirely: [sslConfig] enableSplunkdSSL = false Finally, you can find large assets in your apps, and disable replication in distsearch.conf : [replicationWhitelist] largeFiles = .../largefile.* ... View more

When you specify your regex using TRANSFORMS- in props.conf, this is run at index time and has different properties than search time regexes (specifically, the output needs to be written to _meta with WRITE_META=true ). You can either specify it as REPORT- in props.conf, and refer to transforms.conf. It's even easier to specify inline in props.conf: [c_netflowdata] EXTRACT-foo = (?<thedate>\d+/\d+/\d+\s\d+:\d+:\d+),(?<src_ip>\d+\.\d+\.\d+\.\d+) ... View more

You can explicitly compute the equivalent of date_mday using eval: "... | eval mday = strftime(_time, "%m")" ... View more

Your search syntax looks right, and the stats should calculate the sum of the duration field. You should note that your stats is calculating the total duration for the month, not for the day, so it's not unreasonable for it to be greater than 86,400s. Another possibility is that vpn_user has become a multivalued field and certain sessions are counting against multiple users. I'd pipe the output of transaction to stats sum(duration) count to see what the total duration and number of sessions is, as a sanity check. ... View more

The "(?=\d{4})" is a positive lookahead assertion. It's not strictly necessary, but just ensures that we're only looking for \s+Y immediately followed by four numbers. Your TIME_PREFIX would work equally well. ... View more

If you find yourself setting MAX_EVENTS to be very large, you should probably consider changing the LINE_BREAKER to break the input stream into larger chunks (that aren't single lines). At index time, data is broken into lines (usually by \r\n or \n ). It then may be put back together using line merging. It's significantly more efficient to not have to reassemble the data with string concatenation. You then have to set the maximum "line" length using the TRUNCATE attribute. If you know that every event is demarcated by two newlines, you could set in props.conf: [<sourcetype>] LINE_BREAKER = ((\r?\n){2}) TRUNCATE = 1000000 SHOULD_LINEMERGE = false ... View more

Subsearches are run with the same time range as the time picker selects (which are passed as an API parameter to the search). If you set a time range in the search string, say with earliest=... , it will not be used by the subsearch, only the API parameter. ... View more

_indextime is the time of arrival and is the primary sort order. we break ties by the place it was written. When we roll from one bucket to the next, the address will drop back to zero and increase from there. You may actually want to "| sort _indextime bucket address" to better handle the bucket roll. ... View more

This means that the "host" field was not found in the table passed into the anomalies command. What does the rest of the search look like? ... View more

Do you have to restart splunkd or just splunkweb? ... View more

Yes, this is an undocumented feature of inputs.conf. Any DEST_KEY in transforms.conf can be set directly in inputs.conf. You are correct that the inputs.conf setting goes on the forwarder but fields.conf goes on the indexer. ... View more

The concurrency limit applies independently at each search head only. This means that any individual indexer could have as many concurrent jobs as the product of the per-search head limit and the number of search heads. However, this is unlikely to be a problem in most deployments since the load factor on each indexer is less than one per search. ... View more

Arrival order is in-file order, for any given source. ... View more

If you have repeated "sub" values as in your example, you may want to consider a search like: ... | chart count by cat sub This will make a table like: cat 1 2 3 --- - - - a . . . b . . . c . . . This is useful if you want a stacked column chart to be rendered in the UI, so that you can see each combination as well as the total for each category. ... View more

If you want to hardcode the date here, you can just add | eval Date = "8/31/2010" but I suppose you want to be more clever and have it be based on the search itself. In that case you should add: ... | addinfo | eval Date = strftime(info_min_time, "%m/%d/%Y") | fields - info_* ... View more