Assuming that Splunk is installed as per the recommended reference architecture and hardware, then based on real-world performance in other customers what are the Splunk benchmarks for the following metrics (assuming 5-10 GB data ingestion per day) - Latency [i.e., how long would it take from the point an event is generated to the time it is available for searching / alerting] - Search query response times [i.e., what would be the typical range of wait times before the search result is available] - Data reliability [i.e., what is typically the percentage of data transmitted from source systems that is successfully indexed] - Data integrity [i,e search results should be uniform , it should not change for the same time range when executed later] Is there any standard numbers given offcially by splunk when their standard infra requirements is followed ? ... View more

Hi, I have a list of cities and countries along with latitude and longitude. Name Latitude Longitude India Blah Blah US Blah Blah Now how do I lookup on them and plot on a map visualization in Splunk? (geostats, iplocation, etc) Thanks in advance ... View more

Hi, I have setup a dbmon-tail to fetch data from a SQL query every 15 minutes. It works as expected for a day until night, and suddenly the next day it stops tailing data. Select * from ArcUnion {{WHERE $rising_column$ > ?}} In the interval I have set as 15m. Can you please tell me what's the issue here? ... View more

Hi All, I want to merge two timecharts in a single panel, I have a file transmission tracker query A - which tracks when the file transmisiion occurs. Query B - tracks the triggered alerts ( negative condition - when the file doesnt come) A: index="fxr" fxr_ftpup_filename="DMM02YBRYBRPACEAVAILCOLLAT_*04*" OR fxr_ftpup_filename="DMM01YBRYBRCOLLATNAV_*05*" OR fxr_ftpup_filename="DMM10YBRDMMPaceRepoedgeInstruments_*_02*" OR fxr_ftpup_filename="DMM04YBRYBRPACEREPOTRD_*04*" OR fxr_ftpup_filename="DMM04YBRYBRPACEOTCTRD_*04*" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as FileTransmissionTime | rename fxr_ftpup_filename as FileName,fxr_status as Status| replace "DMM01YBRYBRCOLLATNAV_*05*" with "EXPALGONAV-BNYM TO DMM NAV","DMM02YBRYBRPACEAVAILCOLLAT_*04*" with "EXPALGOPOF-BNYM TO DMM Free Inventory","DMM10YBRDMMPaceRepoedgeInstruments_*_02*" with "EVNT- PRICE DEMAND 01:30AM","DMM04YBRYBRPACEREPOTRD_*04*" with "EXPALGOPOR-BNYM TO DMM Repo Transaction","DMM04YBRYBRPACEOTCTRD_*04*" with "EXPALGOOTC-BNYM TO DMM OTC Transaction" in FileName | timechart span=1m count by FileName B: index=_audit action=alert_fired ss_app=search |convert ctime(trigger_time) as Time | timechart count(ss_name) by ss_name How to merge these both and show it in a single timechart. ... View more

Hi All, How to write a cron a expression that runs only at 4:50 AM and 5:05 AM on a day. Note: I want to save it as a single alert, I want to run it from Monday through-Friday. I tried something like below, but it will run @ 4:50 AM and 5:50 AM. 50 4-5 * * * 1-5 I want to run @ 4:50 AM and schedule it for the next 15th minute . Is this possible ? Please let me know. ... View more

How do I lookup for a field which has Or condition. example Source Destination File name act bank indexes_% bank act indices_% OR integer_% OR does not work, should I use pipe character ? ... View more