There are loads of questions covering this on splunkbase. The docs has very helpful sections on it, too: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest ... View more

I don't know why you are seeing such a large difference, but I suspect one of the reported numbers is just wrong, as the space in both versions should be comparable (e.g., maybe you didn't actually have 18 billion events before, or if they were, they were in frozen state and unsearchable. Without knowing your data looks like, I would say that 18 billion events in searchable form into 700GB seems a bit light to me, but 20 billion in 2 TB seems more reasonable). The data is already about as compressed as it can reasonably be, if it is to be searchable. When rolled to frozen storage (and unsearchable and unviewable from within Splunk without thawing back out) much of the data can be deleted and considerable additional space claimed. ... View more

http://docs.splunk.com/Documentation/Splunk/4.3.1/admin/Setaretirementandarchivingpolicy ... View more

Here is a link to the docs re: license violations. Splunk does not stop indexing data, but it doesn't allow you to search the data when you have exceeded 3 violations on a free license. I believe that this will reset after 30 days of no violations. But check the manual. If you are still having trouble, go to splunk.com and file a support ticket. ... View more

It's not required, but there were a couple security fixes in 4.2.5 so you should at least review the change notes for 4.2.5 to see if they apply to you. ... View more

The above query has asterisk after ccNumber=[0-9] ... View more

I ran into this as well. This happened after I copied some alert from another system to setup on a new search head. The problem turned out to be that I created the alerts before configuring the mail server in Splunk, so the alerts had this statement in savedsearches.conf: action.email.mailserver = localhost Manually edited savedsearches.conf to remove this (as well as action.email.from, which was "splunk"). After restarting Splunk, the alerts mail properly. ... View more

Hey, Can you post what your actual logs look like? I wrote the same report but used mvindex instead of coalesce as i was having an issue where the Account name field was listed more than once and i had to specify which one i needed. It looks like you are trying to combine two fields into one using coalesce. Try using case instead, example: eval UserName=case(k8cname!="", k8cname, User_Name!="", User_Name) This takes field k8cname and User_Name and combines them into one field UserName. A little roundabout but works. I-Man ... View more

Please refer to the documentation: http://www.splunk.com/base/Documentation/4.2/Installation/Aboutupgradingto4.2READTHISFIRST ... View more