Hello, We are including the Pod Namespace and Pod Name in the Log Source (for K8s deployments) and would like these fields (Pod Namespace and Pod Name) to be extracted. source: /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/$(Volume Name)/$(POD_NS)/$(POD_NAME)/*.log Most of our searches (including saved searches) will leverage both, if not atleast one of the two, fields and we were wondering if it is better (performance wise) to do the field extractions at Index Time or at Search Time. It looks like the general practice is to opt for Search Time extraction, however there are may be cases where Index time extraction is preferred. The examples for using Index time extraction mentioned here (https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/Configureindex-timefieldextraction) are not very clear, it seems like the 1st example might apply to our use case and so Index time might be preferred? Thanks, Srikar ... View more

Hello, I went through a few forum posts and Splunk documentations on retention settings but it's still not 100% clear on which properties are needed and what their values should be. Would greatly appreciate everyone's help with this topic. For example: lets say on an average, Index X stores 1 GB data/day and we want to keep the data in Hot/Warm for 5 days and in Cold for 365 days then will the properties below help in achieving the data retention goal? We have 3 nodes with RF and SF set to 3. The properties below were generated by the sizing app. [X] homePath = volume:primary/X/db coldPath = volume:secondary/X/colddb homePath.maxDataSizeMB = 2559 --> ~2.5 GB --> Specifies the maximum size of the directory <>/X/db and if this size is exceeded, Splunk will move buckets with the oldest value of latest time (for a given bucket) into the cold DB until homePath (<>/X/db) is below the maximum size coldPath.maxDataSizeMB = 184319 --> ~184 GB --> Specifies the maximum size of the directory <>/X/colddb and if this size is exceeded, Splunk will freeze buckets with the oldest value of latest time (for a given bucket) until coldPath is below the maximum size. maxWarmDBCount = 100 --> The maximum number of warm buckets default it 300 but we want to limit it to 100 frozenTimePeriodInSecs = 31536000 --> 365 days --> Number of seconds after which indexed data rolls to frozen. If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen maxDataSize = auto --> The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Default will be 750MB/bucket maxHotSpanSecs=432000 --> 5 days --> Upper bound of timespan of hot/warm buckets in seconds. Thanks! ... View more