Ok thanks, the size of bucket then depends on the bandwidth we have between sites which can be obtained by testing. thanks again Mark ... View more

couple of follow up question on this. Can i also have a multi site clustering for search head, so that Site1 search head can search only Site1 indexers and Site2 search head and search only Site2 indexers.. This may resolve a error i am seeing on my indexers related to "underlying storage issues " when too many searches are run.. another question, how quick is the cluster replication, so if a bucket comes into Site1 indexer, is that replicated quickly to Site2 indexer... Trying to understand the time required . ... View more

Thanks.. this will probably help.. ... View more

Asha, i am using 6.5.2 version and dont seem to find this option. looks like its not available in 6.5.2 ... View more

Great , this is exactly what i wanted.. Thanks. ... View more

Vishwa, thanks, could you help elaborate the same, i was able to find the send email option on saved searches, but no option to specify csv.. ... View more

So this means a duplicate copy is always at Site2 . so this also means if i lose site1 , i still have all the data at Site2. this i ask, such that, if i have 5 indexers on site1 and 5 on site2, so i can still have access to all the data even if i lose site 1 , ie all 5 indexers.. right ? even when RF=2 ... View more

Markus , thanks for your inputs. so in this case if RF =2 with Site A and SiteB, does this result in full data being available if SiteA is down ? as alternate copy is available on SiteB. ... View more

thanks for the inputs . i would look at your options.. i do have crcsalt source and max days ago, but we are not purging the files. i will use the batch mode to purge them. i believe that should resolve my problem. ... View more

Yea, good point, this is exactly what i think i am going through. the batch mode , that can read and delete looks to be a good option , so that there are only un-indexed files to scan for, ie less number of files. This is a very good point, let me try on this and get back.. meanwhile, is there any limitation on how many files a forwarder can process comfortably, is there any standard to this, considering i have 12 cpus and 12 GB ram. ... View more

Thanks for the document link ... View more

HiroshiSatoh, Here is the behavior i see, when i add new files for data input , usually csv files. i see they are not detected under "number of files". it shows blank for a very long time, as suggested, for 6 hours or more . once i see the number of files there ,the indexing is immediate.. and i see the data. the delay is for forwarder to detect the files. so i was guessing , that there are too many files for splunk to scan and hence this is causing the delay for detecting those files. as mentioned, once these are detected and i see numbers under "number of files" the indexing happens quickly.. here is where i see issue splunk website -> Settings -> Data Inputs -> Files & Directories-> Look for my input files-> the "number of files" column is blank -> This stays blank for more than 6 hours -> Once i can see numbers here, the indexing is quick ill also check the points mentioned by you above.. ... View more

Hi Frank, Thank you for your input, that was good info ... I still have to do some more reading before implementing this.. ... View more

or can you direct me to a DMC tutorial/document ... View more

Pretty new to DMC, could you help where i should start to look for CSV indexing delay issue.. Too many options to look. The CSV files arent large in size , but large in number. ... View more

Ravi, i got it to work with html code printing outside the chart. this looks good. another problem i saw was that when i get the radial gauge to work and click on the refresh button at the bottom of the panel, the color arrangement goes away and i can see only yellow .. ... View more

Great, this works perfect, thanks a lot Ravi. Probably you can help me on one more thing. Is it possible to print a text on the radial bar. would like to show the actual number printed of which the percentage is calculated. ex: 95%, would like to show as 95% of 2000, where 2000 is the actual number of items. ... View more

it works with > however, based on values the color of the whole gauge change. is it possible to show RED beyond the actual percentage and the appropriate color before the percentage. ex: if its 56%, then 0-56 on the dial should be yellow and 56-100 should be RED is it possible.. ... View more

Tried, this, get the error below at line 16 Error parsing XML on line 16: StartTag: invalid element name ... View more

I tried the solution in the html above, but i get below error on the code at line 21 . could you help Error parsing XML on line 21: StartTag: invalid element name ... View more