You set this in serverclass.conf. stateOnClient = enabled | disabled | noop * If set to "enabled", sets the application state to enabled on the client, regardless of state on the deployment server. * If set to "disabled", set the application state to disabled on the client, regardless of state on the deployment server. * If set to "noop", the state on the client will be the same as on the deployment server. * Can be overridden at the serverClass level and the serverClass:app level. * Defaults to enabled. ... View more

That's defined when you accelerate a data model - "summary range". You can see which range is currently defined for each data model by looking at the acceleration info for the data model in the splunkweb settings, look for the summary range there - that's the retention period. ... View more

Not sure why you'd need streamstats. streamstats does not have a time-based window parameter, only number of events. You could simply do ... | stats range(Count) as diff by Server ... View more

The only possible issue I can think of is if you start adding tags that are also part of the CIM and therefore potentially incorrectly interpreted by ES to be part of some kind of event that they're not. If your tag has nothing to do with ES tags though, there shouldn't be an issue. ... View more

Indexing is the process of storing all the data that goes into Splunk and make it searchable. This is the core of what Splunk does. I don't entirely understand the rest of your question - I guess you're not after getting detailed information on what Splunk DOES when it indexes data. Which data you should be indexing is entirely up to you. ... View more

How about sourcetype=uag user=bigrichie90 (action=added OR action=removed) | transaction session Or if you really don't need anything other than the duration, just sourcetype=uag user=bigrichie90 (action=added OR action=removed) | stats range(_time) by session ... View more

You could do this with streamstats. ... | streamstats global=f window=2 latest(documentId) as nextdocid, earliest(documentid) as thisdocid by user | where nextdocid-thisdocid=1 ... View more

If a field has the value "NULL", then it really has that string as a value. It could equally be "FOO", "ERMAHGERD" or anything. So, where user="NULL" searches for events where the user field really exists and has that value, whereas where isnull(user) looks for events that doesn't have that value at all. You would achive the same with " search NOT user=* ". Because isnull(user) means that the field doesn't exist, isnull(user) AND mvcount(user)=1 will never match. ... View more

Whoa, unless I'm misinterpreting your intentions you're doing this way harder and heavier than it needs to be. The key thing here is to make sure you can get the error messages extracted to a field that you can match against (let's call it errorTag in both the lookup and the field extraction). After that you can easily get your results through a rewritten search looking something like this: index=app_index source=*/application.log [inputlookup knownErrorList.csv | fields errorTag] | stats count by errorTag If you're hitting the subsearch limit, you could do this: index=app_index source=*/application.log errorTag=* | lookup knownErrorList.csv errorTag OUTPUT component | search component=* | stats count by errorTag Again, the key thing is to create that field extraction. If the placement of these error messages are completely random you could: a) go punch your developers in the face, and/or b) create a field extraction that simply matches each error string explicitly - like, REGEX = (Error String 1|Error String 2|Error String 3|...) ... View more