When using clustering / index-replication, the master selects a list of peers, which will be target for the next bucket after a roll. I'm curious how the master selects the next peers - is this selection intelligent (based upon free disk space, CPU/IO load or similar) or just based upon round-robin or random? it would be great, if this algorithm could be tweaked so that uneven-sized peers can be utilized most efficient. Best regards, Karsten ... View more

I have an apache-like access log and would like to graph the traffic by hour. However, the graph I want is a graph of the number of requests pr. hour divided by 60*60 so that it is easy to identify the busy hour expressed in requests pr. seconds. I assume I have to use bins or span, but I have been unsuccessful so far. Any hints? ... View more

Hi I'm considering to build a shared Splunk instance and offer it to our hosting customers. Each customers data goes to their own index and their search scope is limited to that index, so security/customer separation is ok. But if a single customer suddenly generates more data, than our license permits, then he can block the other customers from searching (well - if it happens 7 times in a rolling 30 days, at least). That situation is of cause not acceptable. Is there any way to stop incoming data or limit it to a certain amount? Best regards, Karsten ... View more