You can change the host field at index time with a "TRANSFORMS" property: ## props.conf [mysourcetype] TRANSFORMS-force_host_for_mysourcetype = force_host_for_mysourcetype ## transforms.conf [force_host_for_mysourcetype] DEST_KEY = MetaData:Host REGEX = \d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+server=(\S+) FORMAT = host::$1 You can create a dashboard using the following search. The dashboard creation itself can be a bit tricky. We may have to incorporate the "rangemap" search command and map 0=low 1=severe. sourcetype=mysourcetype | stats last(state1) as state1, last(state2) as state2, last(state3) as state3, last(state4) as state4 by server, env, os | addtotals fieldname=stateTotal ... View more

Answers prior to the release of Splunk 4.3 in January 2012 are somewhat out of date. In that release, indexed JSON can now be extracted as structured JSON fields, either automatically via a new KV_MODE = json setting, or on-demand using the new spath search command. There is no need to create a new search command, and you don't need to flatten or reformat the input. ... View more

Hello all, thanks for you support, I think we solved the Problem. The Problem was neither I/O or CPU I was just the parameter maxclient% which controls how much memory can be consumed for filesystem cache. Just to complete this question the well formated output of vmstat -v 4194304 memory pages 4040624 lruable pages 2224021 free pages 2 memory pools 485051 pinned pages 80.0 maxpin percentage 1.0 minperm percentage 80.0 maxperm percentage 31.6 numperm percentage 1277976 file pages 0.0 compressed percentage 0 compressed pages 31.6 numclient percentage 80.0 maxclient percentage 1277976 client pages 0 remote pageouts scheduled 370 pending disk I/Os blocked with no pbuf 0 paging space I/Os blocked with no psbuf 2228 filesystem I/Os blocked with no fsbuf 3261 client filesystem I/Os blocked with no fsbuf 894 external pager filesystem I/Os blocked with no fsbuf 0 Virtualized Partition Memory Page Faults 0.00 Time resolving virtualized partition memory page fault The Problem with the License Calculation still exists but seems to be a different Problem. Search Performance is for the moment OK. Setting vmo Parameter vmo -p -o maxperm%=80 vmo -p -o maxclient%=80 ... View more