I think you're confusing some things. First of all, an "index" in Splunk is what you would otherwise call a "database" in an SQL world. Splunk's indexes are however not very much like SQL databases. Splunk indexes data without using a set database schema. Instead it identifies unique segments in data and stores metadata about in which events these segments can be found. Fields do not really exist until when you issue a search - a very few select fields are set at index-time (such as host, source, sourcetype, _time and a number of other internal fields) but the rest are created at search-time and it is important to note that creating more index-time fields does NOT boost performance other than in few special situations - often it's rather the opposite. This is usually a difficult concept to accept if you come from the SQL world. For more information on how Splunk handles incoming data, read dwaddle's explanation about it here: http://answers.splunk.com/answers/54207/slow-search-when-evaluating-a-numeric-value?page=1&focusedAnswerId=54224#54224 ... View more

I imagine you could achieve something like this using a combination of eventstats and streamstats . ... | eventstats count as totalcount | streamstats count as dcount by Client,Policy,Schedule | where count>20 AND dcount<2 eventstats gets the total count of events and streamstats assigns a running count for each combination of Client,Policy,Schedule. where then checks if the condition that count>20 has been met and if so it filters the events where dcount<2 , that is, only 1 event per the combinatioin you want to dedup on. ... View more

Yes. You can do EVAL statements in props.conf: EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z") http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf ... View more

That's because your regex doesn't match the new events. I put your sample events and your regex and put them into a regex checker (in this case regexpal.com but any tool of your choice would do, including Splunk's own regex command). You need to rewrite your regex. What the final regex would look like is left as an exercise to the reader 😃 Because I don't know the full extent of your data so it would be dangerous to guess which events should and should not match. EDIT: For what it's worth, the main problem I see with your regex with respect to your new data is that the new data contains a space character in the 6th field ("CBQoS ClassMap"). \w will not match this so you might want to consider changing " (\w+\|) " to " ([\w\s]+\|) " in your regex. ... View more

They're internal functions like most other Splunk commands and functions and as such do not have available source anywhere in a Splunk installation. ... View more

Splunk comes bundled with its own Python environment. You could either set your PYTHONPATH in order to make use of the packages available in it, or better yet you should run Splunk's python completely: /opt/splunk/bin/splunk cmd python <yourfile.py> . ... View more

There is an excellent page on the community wiki that has lots of info on this. Here: http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine ... View more