Take a look at Correlation searches: http://docs.splunk.com/Documentation/ITSI/3.1.2/User/Createcorrelationsearch Or Multi-KPI alerts: http://docs.splunk.com/Documentation/ITSI/3.1.2/User/Createmulti-KPIalerts ... View more

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report. You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report. Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster. http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels ... View more

Try this: (host=10.29.4.*) OR (host=10.29.10.*) | rex field=host "10\.29\.4\.(?<range_10_29_4>\d{1,3})" | rex field=host "10\.29\.10\.(?<range_10_29_10>\d{1,3})" | where (range_10_29_4 >= 48 AND range_10_29_4 <= 63) OR (range_10_29_10 >= 0 AND range_10_29_10 <= 63) | eval range=coalesce(range_10_29_4, range_10_29_10) ... View more

The best practice would be to run it on a heavy forwarder. Generally, you don't want to use Search Heads for data collection. ... View more

Take a look here. This should help you understand the key concepts of ITSI such as Services, Entities, Health Scores, KPIs, etc... ... View more