Some data types only give you about a 50% reduction in space, so you could be guessing low. However, you can simply cap the retention at 180days with frozenTimePeriodInSecs = 15552000. If you don't want to keep anything after that, don't provide a frozen path, and the data vanishes neatly. ... View more

This must be accomplished outside the Splunk application(s). Use OS level controls, so as ulimit settings on *Nix systems, or things like Cgroups in RHEL based systems. ... View more

This is no longer true. ... View more

Is this all fixed for you in v6? ... View more

We have systems with dozens of largely inactive users on similar size machines, but the heavy users tend to cluster on the indexer with 48G RAM and 24 cores. Based on Splunk information, as linu1988 points out, you should count on 1 core per active search during the life of that search and about half a GB of RAM - plus you'll need some level of overhead for the indexing volume. So, with 16 cores, you will easily be able to run a couple dozen concurrent searches if the indexing load isn't that high. However, this includes all scheduled searches/alerts, interactive, background, scripted, and dashboard searches. My advice is to try it and see what your load ends up being. If you hit resources issues for doing searches, fire up a search head VM to run interactive stuff or to off-load saved search/alert functions. You could have a search head you use just for certain dashboards, for example. ... View more

Install the Splunk on Splunk app and go to Data Inputs -> File Monitor Inputs to see where this is likely configured and how it is set up. Also, search the entire Splunk Forwarder for any file named inputs.conf and then be sure to look in every one of those files. It might not be written into the file in the exact way you expect, so you may have to search for a subset of our file path, say just one directory in the path, to find it - or just look manually as there aren't that many places to look. ... View more

Does this help? http://answers.splunk.com/answers/10349/chart-only-showing-1000-events ... View more

In Splunk, you can't without using 3rd party libraries and building your own UI for it. ... View more

oooh right. nice catch. I edited the search. Thanks! ... View more

Try this: index=* earliest=-30m@m | dedup index sourcetype host| stats dc(host) AS hostcount,values(sourcetype) AS stlist by index Enjoy. ... View more

I consider this a problem to be tuned on a per search basis. Generally I try to avoid doing the NOT this NOT that approach, but we all have to do it at times. I find it generally better to tune each search because there might be a case where something is a false positive for one search but not another search. In addition, as you noted, there becomes a management overhead and possible performance issue with it growing too big. You could make a saved search of fps that included all the other eventtypes, tags, macros, or other saved searches you create to mark false positives, but having a single definition used in too many places might bite you in the future. So, specifically I try to change my searches to be more specific in ways that won't find false positives and don't require negating a bunch of stuff manually. This is easier done with more complex profiling rather than simpler pattern matching searches, of course. ... View more

I'd go with MuS' suggestion: start with forwarding EVERYTHING to syslog then slowly build your config out to forward only those things you want. Also, this is possibly useful: http://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data ... View more

If you are using a saved search, check the nosubstitution in the savedsearch command. ... View more

What is actually happening? Obviously it isn't fully functional, but have you looked at tcpdump on the Splunk forwarder to see if the data going out that port looks correct? Have you looked on the syslog end-point system with tcpdump to see if it is getting any data in on that port? ... View more

Use eventgen. ... View more

That 5 minute window is sliding. It is constantly moving as the search is updated every second or so. Read http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutrealtimesearches#Real-time_search_mechanics for exactly how it works. ... View more

Use this: | rest /services/data/indexes count=0 Enjoy. ... View more

It gives you all the results in a sliding window. If you have an active dashboard or if you are waiting for an event to trigger for testing something, a RT search with a 5 minute window might be quite useful. Also, scheduling a RT search means you get instant alert triggers for any conditions that should be met. This means within seconds of the matching criteria being written to the indexes, an alert is fired. Most people don't need anything better than a scheduled search running every five minutes or even every minute that looks back that five minutes or single minute, though. ... View more

Don't forget to mark it as answered 🙂 Glad I could help! ... View more