That is an option. Depending on how your UFs are managed and how many you have, another option may be to follow instructions to move your existing indexes from your old server to your new server (setting up indexAndForward from the old server to the new server) http://wiki.splunk.com/Community:MoveIndexes (you'll double index until you change the UFs over to point directly at the new server, but this way you'll have more than just the past day of data.) I'll admit however that I did this between two Linux servers, and I'm not sure if between windows and Linux is possible or not. ... View more

Comment because I don't know the exact endpoint and where filter offhand but this is something that can be found in Splunk's REST api. Therefore you can use the | rest search command to get to it. Your search will take a form like: | rest splunk_server=local /servicesNS/-/-/saved/searches | where disabled=1 (But as I mentioned this is off the top of my head, you'll want to play with the REST API reference and make sure toes are correct) ... View more

The flaw here being there is no guarantee each nth sub search result corresponds to the nth main search result. ... View more

So you want the TxnId,Queue for those in Search A... and the min(_time) and max(_time) for those that match whose TxnId is retrieved by ... ... View more

@Murali2888 can you describe more about the subsequent search? Why do you need to provide TxnId? ... View more

I'm not sure what it'll do in terms of performance, but how about: <search A> | fields TxnId,Queue | dedup TxnId | append [search <search B or C> | stats min(_time) as start_time max(_time) as end_time by TxnId | eval total_time = end_time - start_time | fields TxnId, total_time] | stats first(*) by TxnId | table total_time,Queue Based on your comment, if search A is relatively fast, then we can do a subsearch to qualify with only those TxnIds in : <search A> | fields TxnId,Queue | dedup TxnId | append [search <search B or C> [<search A> | fields TxnId | dedup TxnId] | stats min(_time) as start_time max(_time) as end_time by TxnId | eval total_time = end_time - start_time | fields TxnId, total_time] | stats first(*) by TxnId | table total_time,Queue ... View more

Replace the gentimes command with something that generates a result with starttime and endtime set to the timestamps of each start and end that you want to compare. Eventstats and the eval figure out the offset and then run the mapped search for each timerange ... View more

In answering your follow up question I felt like this had some strange machinations of its own, so it deserved it's own answer. (vote up if it's useful, or if mods can take your follow up and this answer and split them out into a new question, that'd be cool too). The goal being a timechart of the number of players in a particular tier, making sure to remove them from their last tier when they bump up tiers. First the solution I came up with: :: your search :: | streamstats max(result) as tier by player | dedup player, tier | eval add = 1 | streamstats current=false last(tier) as remove by player | appendpipe [search remove=* | rename remove as tier | eval add = -1] | sort count=0 _time | streamstats sum(add) as in_tier by tier | timechart last(in_tier) by tier | streamstats last(*) as * So let's break this down. | streamstats max(result) as tier by player | dedup player, tier - Find the player's tier for every record, and limit only to the times the tier changes | eval add = 1 - for every result we have now, we want to add one to the tier. | streamstats current=false last(tier) as remove by player - at every step, find the last tier the player was in if any | appendpipe [search remove=* | rename remove as tier | eval add = -1] - for every previous tier, add a result for the same time, for the previous tier with the add being a decrement instead of an increment. | sort count=0 _time - put the decrementing results in the proper time series order | streamstats sum(add) as in_tier by tier - calculate the number currently in each tier as each record comes in | timechart last(in_tier) by tier - for every time segment, the number currently in the tier is the last value we saw for a number in the tier for any given tier | streamstats last(*) as * - fill in gaps where a a particular time segment has no change for a particular tier and voila! Now dear reader, I'll leave it as an exercise to you to figure out the best way to start each tier in your search with a particular non-zero value. (but you probably want to insert events at the same time as or just before the first event or the beginning of your search window with tier and add fields specified before calculating the number in a particular tier). ... View more

That's correct. stats is removing the _time field. It'd be quite a bit of a different search, involving likely a dedup, maybe bin as well. ... View more

Updated answer per comment 🙂 it actually seems to become much easier if you already have priority numbers. ... View more

I'll admit I'm not entirely sure this is correct, because I'm not using the CIM just yet. Anyways, if you follow the documentation link from the CIM download page you'll find a document on "Use the CIM to normalize data at search time". That doc says: If you haven't already done so, get your data into Splunk Enterprise. Do not be concerned about making your data conform to the CIM in the parsing or indexing phase. You normalize your data to be CIM compliant at search time This leads me to believe that you want to install the CIM on search heads not indexers or forwarders. ... View more

Could you explain more on why you need to move indexed data between indexes? Different retention policies and/or different access policies = create and put data into different indexes and let Splunk handle the deletion for you. Splunk will "freeze" buckets when either they get too old or the size of the index is too large (both configurable). At that time Splunk will remove the bucket from searching and will delete, archive, or perform another custom action (again based on the index configuration) ... View more

Let's assume no timewrap command, We could do something like this answer and use gentimes and map to loop over the periods we're interested in: | gentimes start=-1 end=1 | eventstats max(starttime) as maxstart | eval offset=maxstart-starttime | map search=" search starttimeu::$starttime$ endtimeu::$endtime$ index=summary search_name=\"Events Counts by Message\" MESSAGE_TEXT=\"Authentication succeeded\" | eval key_text = strftime($starttime$, \"%Y-%m-%d\") + \" \" + MESSAGE_TEXT | timechart span=1h count by key_text | eval _time = _time + $offset$ " | stats first(*) as * by _time You could even adjust the start and end on the gentimes and get more or less easily. ... View more

Are you able to install apps on your instance? If so, are you looking for something like the timewrap command ? ... View more

Is the splunkd process for the UF running as the "root" user on all systems or is it running as a limited "splunk" or other user on some or all? If running as a limited user, are there permission differences on /var/log and the files within? (this may manifest and you may see "Permission denied" messages in the _internal index. ($SPLUNK_HOME/var/log/splunk/splunkd.log) ... View more

This is indeed what was asked for, however, depending on what you're doing with this, you may want to look a bit deeper: 1) "Top Level domains" for some country codes you may actually want the 3rd level. For example: "amazon.co.uk" 2) You need to include hyphens and other characters as well, otherwise you may miss some domains. Of note internationalized domain names are actually prefixed: xn-- ... View more

Makes sense and as I mentioned it's a possibility. But you'd need a scheme to make sure you're not fighting Splunk's indexing or an addon to pull the data from somewhere else. If you're a developing type you can roll your own Splunk app / addon. It might make for an interesting app. If you're ambitious you could build and submit to their recently begun contest ... View more

Offhand, I believe the search head only needs to invoke the Splunk API port of the search peers (and cluster master), but I'm trying to find docs before making an answer. ... View more

It doesn't look like you can setup Sideview Utils with the online sandbox. What you can do instead however is download Splunk Enterprise and set it up on a local machine. (There's also a slightly older version that you could use from the AWS Marketplace as well). This will run with a trial license to start with, but can be switched to the free license if need be. You can obtain Sideview Utils from their website and then when you log in to your Splunk enterprise instance there's an "Install app from file" option that you can use to install sideview utils. You'd likely also want to look into either uploading some data to your instance or look into setting up an event generators so you have data to play with as well. ... View more