It really depends on the errors that you are getting. For example if you are getting a lot of Exec processor errors it could be that Splunk can't run a script because of permission issues. That probably won't affect performance that much. However, if you see a lot of Regexor processor errors it probably means that you have a lot of slow or inefficient regexes. Or maybe you've got events with more than 256 lines and based on your configuration, you are truncating events without times stamps and that will slow splunk down. If you up the event size in this case, it would help those errors. If you see Aggregator process, Date processor verbose then those are all related to props.conf and you could be having issues with line breaking, line merging or time zone issues which could certainly affect performance. There are a lot of variables and it might be worth a call into support or if you think it's the right time to clean up your environment you can bring in our Professional Services team to do some work and show you what to look for in the future while the fix the existing issues. ... View more

No you do not need to edit all of the files. Please look at this link below in the docs for file precedence. In most cases you'll create a new file under /system/local for props.conf and transforms.conf but it really depends. As long as you are not changing the default directory you are ok, since that is really for the base system or application. Changes within 'local' won't be overridden when you upgrade versions of Splunk. http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Wheretofindtheconfigurationfiles ... View more

It sounds like you want to do something like this: http://splunk-base.splunk.com/answers/54981/specify-a-time-window-to-search-during-non-business-hours The time modifiers will apply to the timestamp for your actual events. Therefore, you can specify a search with earliest=-2d@d latest=-1d@d to only look at data based on your search for 2 days ago only or earliest=@w0 to search events since the beginning of the current week. http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/SearchTimeModifiers ... View more

This should help you achieve what you are looking for. http://splunk-base.splunk.com/answers/47780/how-to-suppress-extra-_time-line-on-timechart-in-dashboard ... View more

Not a problem. You can just go back to Splunk.com, download the right package and install it on your server. ... View more