* You have to add a question mark (?) with where condition and DB Connect would replace the checkpoint value of rising column there. (Please read the instruction in the UI just below the rising column option.) * You can apply it on artificially generated columns. But last time when I had a similar situation I couldn't able to do it through UI. So I had to create input start in db_inputs.conf from the backend. ... View more

Hello, Quick answers for the first two: Question 1) You would have to purchase Phantom for each environment. The per-seat model doesn't work across instances. Your sales engineering can help answer further questions on that . Question 2) This is not something we support today but is a planned feature. For question 3, there is a blog here: https://www.splunk.com/en_us/blog/conf-splunklive/introducing-the-splunk-phantom-platform-version-4-0.html (which is a little dated but still in the 4.x family) and documentation here: https://docs.splunk.com/Documentation/Phantom/4.8/Admin/Clustering ... View more