The decision can be determined by answering multiple questions: Is the data going to be queried simultaneously? That is, will you ever need to search for dev/prod at the same time (in the same query)? If no, you can separate the data by env. Are different sets of users going to require access to different indexes? If so, yes, you should separate the data into separate indexes. Are you managing a high volume of data? Then yes, separating into separate indexes may provide you with better search performance particularly if you are only searching one env at a time. Ultimately, it is up to you. The data (most likely) will have inherent features that separate it, either by host, source or sourcetype so, while a separate index is not required, consider the other benefits of separating your data. ... View more

Use snap-to month: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/SearchTimeModifiers#How_to_specify_relative_time_modifiers earliest=-1mon@mon latest=now ... View more

Use tstats and specify the variables: index=main earliest=-30d groupby (_time, sourcetype) span=1s | tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype ... View more

<searchTemplate>index=_internal earliest=$earliest$ | head 10000</searchTemplate> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="earliest" searchWhenChanged="true"> <label>Select a time:</label> <choice value="-4h@h">Last 4 hours</choice> <choice value="-12h@h">Last 12 hours</choice> <choice value="-24h@h">Last 24 hours</choice> <default>-4h@h</default> </input> </fieldset> ... View more