Thanks for your reply. Yes, CM will push out the bundle, I guess we will have to test and see if it requires rolling restart, I know in our environment, the rolling restart can cause a lot of issues. I was just wondering if there is a better or an official way to handle this rather than writing our own script. ... View more

You could store in Splunk the already aggregated data to correlate them to other data. One of our customers has a customer console using Nagios logs where there are many aggregation rules and threesholds; to avoid to ingest all the data and replicate all the aggregation rules, we ingest in Splunk only alerts and warnings from this console. Bye. Giuseppe ... View more

Possibly too much information: I'm using these "top 10" tables with data bars for drilldown. I originally wanted to use tag clouds (which is what I'm using in equivalent dashboards on a different analytics platform), but it wasn't immediately obvious to me how to add drilldown behavior to either the custom tag cloud viz in the Splunk-built dashboard examples, or the Wordcloud viz. So I "fell back" to using tables (which support drilldown out-of-the-box via Simple XML), and added data bars to offer the feeling of "scale" that font sizes in tag clouds offer. In case you're wondering, I don't simply use bar charts with drilldown because, in my data, some values can be relatively huge, dwarfing the bar sizes of others (even in the "top 10"), so there's not much "bar" to click on for drilldown. This problem is avoided in tag clouds by having a minimum font size. ... View more

Jrodman Sorry to dig up a 3 year old question but wanted to expand the question a little bit. I understand that the streaming of data from FWDr to IDXr, stream of data from IDXr of origin to N IDXrs and the commit is reflected back to the forwarder. I'm assuming this is the scenario if you have useACK = true. But from a searching perspective, if I am running a real time search on the IDXr of origin, will I only see the data after the commits have happened at all participating N IDXrs or after the streamed data has made its way through the data pipeline? I would assume its the latter of the two, but wanted to make sure. This question came up at one of my customers where were setting up a multi site cluster. Thanks! ... View more

Deployment server is the way. Otherwise you have to use your own devops tools (puppet, chef, scripts....) ... View more

I think you should simply clean the corresponding index. Clearing the index will clear all the existing events but will also automatically index the existing data from datasource if its configured to continuously pick data from datasource. I had this problem with csv file as datasource and this approach worked for me. To clean index, visit http://www.manvir.net/how-to-remove-the-events-from-splunk/ ... View more

Made the change described above then recycled Splunk and it now works like a champ. Thanx! ... View more

To get rid of null values you can fill them with the previous value using the filldown command. ... View more