About davidcruz

davidcruz · ‎11-19-2018

I'm having the same issue. Did you correct this problem?

davidcruz · ‎10-04-2018

You can create a search to evaluate what's the average data size your source is producing: index=_internal Metrics group=per_source_thruput series="name_of_the_source_you_defined_in_dbx" | stats avg(kb) For the email alert, you can simply create an alarm to fire when avg(kb)=0, for example.

davidcruz · ‎10-04-2018

Have you tried ..| timechart dc(clientip) span=1h by hosts usenull=f

davidcruz · ‎04-20-2018

Hello guys, After creating my indices in the Indexer and configure it as a search peer of my Search Head, I was able to search through every index that I've created in the Indexer. BUUUT, when defining a role in the Search Head, I can't limit those indices because the index list only shows the Search Head indices.... Is there any way to resolve this, without duplicating these indices on the Search Head? Thanks in advance 🙂

Posts	4
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎04-20-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is it necessary to create indices, both on Search ...

Re: DB connect data input error message. Any one k...

Re: Splunk DB Connect: How do you set an email ale...

Re: How do I take an hourly count of one field val...

Is it necessary to create indices, both on Search ...