LINE_BREAKER and BREAK_ONLY_BEFORE are both props.conf settings, and they're used in different parts of the parsing / indexing process. You can see a detailed chart of this on the Splunk Wiki. But LINE_BREAKER defines what ends a "line" in an input file. By default it's any number of CR and LF characters. (Depending on your format of your input, this could need to be altered for correctness, or if your log format can be separated into events by a simple regex, LINE_BREAKER can be altered to find the event boundary, and SHOULD_LINEMERGE can be set to false to skip the next step of the process). During the next phase, Splunk takes the individual lines and combines them back together to form events. (Certain log formats may have multi-line events, especially stacktraces). BREAK_ONLY_BEFORE is one of many attributes used to determine where the event boundaries are. ... View more

If I'm correct as to what you're asking, it may be as simple as instead of using stats using chart | chart sum(ORDERTOTAL) over age_group by index ... View more

I'm not sure if this is it, as I haven't looked deeply enough to do the math but I think your format should be TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z since the - is part of the timezone specification (UTC-04:00 versus UTC+04:00) ... View more

After ingesting your logs, Splunk stores thes logs in indexes. The default index is main, but often times people create their own since it's at this level where you can define access controls and (applicable here) a retention policy. You might be interested in this doc: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setaretirementandarchivingpolicy For each index, you can tell Splunk to freeze (by default this means delete, however it could be configured to mean to archive to long term storage) data that is too old or when the index contains too much data. By default these are very large (7 years 500GB if I remember correctly) but they are likely the parameters you're looking to set in indexes.conf ... View more

So borrowing a trick from Kyle Smith's conf2014 talk... We could do something like the following: serial_num="NTEST9B" | eval p_{phase} = _time | stats first(p_*) as * by serial_num,host,segment_id This gives us results that has the callresult time and the precall time for every host and segment id for a given serial num. The calculating the difference is as simple as ... the above search | eval difference=callresult-precall difference being of course value in seconds since _time is epoch time. ... View more

You could use appendpipe to use stats to add the statistics rows like this: <existing query> | appendpipe [stats sum(percent) as percent by index] | sort index ... View more

It looks like you're interested in the changes over time so off the top of my head maybe something like: index=os sourcetype=df host=* mount=* | streamstats last(storage_used) as last_storage current=f by host,mount | eval host_mount=host.":".mount | eval delta=storage_used-last_storage | timechart sum(delta) by host_mount ... View more

The page you grabbed this quote from, is about creating index time fields. Above this quote, there is a section ("Where to put the configuration changes in a distributed environment") that in order to successfully create an index time extracted field, there are changes that need to be done on a Search Head, while others need to be done on the Search Peers (indexers, or heavy forwarders depending on your architecture). For many people (with small environments, or just using the Free license), these Splunk instances are actually one in the same, but as you scale up Splunk, they start to live on separate machines (and clusters of separate machines). If you make a change to your forwarder, usually you'll only need to restart your forwarder. Sometimes there are cases for something to work as you expect it however you'll need to make changes to multiple Splunk instances and restart all of them. ... View more