One thing that I've noticed, and it may be something that I'm doing incorrectly, but when I search for an event containing, say, "connected from" and I get say 15 results, when I attempt to run the extraction on the results, it pulls everything else in as well. Often more than 1000 lines of information are shown without what I was searching specifically for, being available. The default Splunk extraction utility does the same thing. For example, in our firewalls, we log packet teardown data as well as the vpn logins. So, if I issue "WEBvpn session started NOT Teardown" I end up with the results that I'm looking for, just the vpn session started events. Then, if I attempt use either the internal extraction utility OR this app, up to 1000 events, regardless if I'm using latest, diverse or outliers, I end up with all of the Teardown information clogging up the results. ... View more

I have an issue, possibly a misunderstanding that I'm trying to get cleared up. The company that I work for recently purchased a 10Gb license with Splunk. As we are now adding additional logs to index, I need to expand that. I understand that I can upgrade my existing license to 20Gb, but I believe that 30Gb would be better. When I contacted our rep, I was informed that my options were 20, 50 or 100+. As this is an enterprise license, according to the docs, I should be able to stack these with additional 10, 20, etc sized licenses and lump those index volumes together. I've attempted to contact Sales via the contact Sales form, and it gets forwarded back to my rep, so I've also attempted to contact sales via voice to see if I can speak to someone live other than our current rep to verify this is indeed correct. Has anyone had this type of issue in the past? I'm on current version, 4.3.3 and plan on implementing a license manager with two indexers. I'm just curious if I'm not understanding how the stack and pooling of licenses really works with Splunk. ... View more