Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ... your search | fields - labelDataSpec | chart count by labelData | sort - count /K ... View more

Not that I've tried it (yet), but I assume that a fieldX that holds an arbitrary string like in your examples could be formatted like so; ... | eval fieldX = lower(fieldX) | makemv delim=" " fieldX | mvexpand fieldX | eval A = substr(fieldX, 1, 1) | eval B = substr(fieldX,2) | eval A = upper(A) | eval fieldX = A.B | fields - A, B | mvcombine fieldX | eval fieldX = mvjoin(fieldX, " ") maybe.. EDIT: Needed to remove the temp fields in order for the mvcombine to work ... View more

There is no such thing as a single-user license, as far as I know. As of version 4.2(?), there is a mechanism within Splunk, that allows several instances to share a single license, i.e. one of the instances is designated as the 'license master', and the other Splunk servers connect to the license master to report on license usage. Read more here; http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/HowSplunklicensingworks /K ... View more

Yes, %m is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b . Also, you might want to change the %Y to %y , since you only represent the year with two digits. Then you can add the milliseconds as well. TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N http://www.strftime.net /K ... View more

You probably want to look at a certain SID in the events, either the first or the second, and compare that SID across events. Since the Security_ID is present more than once in these events, Splunk creates what is called a multivalued field. The individual values of the field can be accessed with various functions. You can then build so-called transactions based on this, e.g. your search for events | eval sid2 = mvindex(Security_ID, 1) | transaction sid2 maxpause=5s Read more here; http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions /K ... View more

From a storage perspective, you should treat hot and warm the same. They must exist in the same path, and the only difference is that hot buckets are actively being written to. In your case, as you just have a single drive, there is no real difference between hot/warm and cold either. The definition of the paths for hot/warm, cold and frozen for an index can be done in the GUI, or in indexes.conf. As for the retention time, it is controlled for the index as a whole, i.e. hot+warm+cold. This can only be defined in indexes.conf. What you probably need is to set the retention time to 18 months via the following setting, which is equivalent to just under 550 days (~18 months); frozenTimePeriodInSecs = 47500000 Additionally, you'd like to set the total size to a higer value than the default 500GB; maxTotalDataSizeMB = 1900000 Assuming that you index 3 GB of raw logs per day, and with an average compression ratio of 50%, your 2TB drive will last you more than 3 years. As for backing up, you should read the following; http://docs.splunk.com/Documentation/Splunk/6.0.1/Indexer/Backupindexeddata Hope this helps, /K ... View more