simple and efficient ... View more

Great it worked, if it really helped you then you can accept/upvote my answer. ... View more

That was my intention ! I don't see how change the "accepted answer" ... View more

7.1.2 update works for me too. 🙂 ... View more

It isn't possible to run a function like sha256 on a value before indexing, unless you do it before it gets to the forwarder or the HEC. My suggestion would be to do this function before it gets touched by Splunk if you want to save that much licensing, or the data itself isn't that important. Now if the data isn't needed at all you can remove it completely before indexing using a SEDCMD in your props.conf . ... View more

The difference between using extract during in your search and setting up search time extraction is with search time extraction, the fields are available for using without having to extract them every time. Also allows you to create aliases etc. With the extract command, you will have to repeat the extraction with every search. To enable to search time extraction, you will need to make the following changes *Transforms* [kv_pair_delim] DELIMS = ",", "=" *Props* [your sourcetype stanza] REPORT-activity = kv_pair_delim ... View more

Just to know, did you modify one of this settings ? "search_process_memory_usage_threshold = * To be active, this setting requires setting: enable_memory_tracker = true * Signifies the maximum memory in MB the search process can consume in RAM. * Search processes violating the threshold will be terminated. * If the value is set to zero, then splunk search processes are allowed to grow unbounded in terms of in memory usage. * The default value is set to 4000MB or 4GB. stack_size = * The stack size (in bytes) of the thread executing the search. * Defaults to 4194304 (4 MB) status_cache_size = * The number of search job status data splunkd can cache in RAM. This cache improves performance of the jobs endpoint * Defaults to 10000" What is you usage per core ? perhaps did you already made empirical settings and compare the processing time obtained for the same search ? ... View more

Hi splunkLPN, have a look at the docs about Splunk 6.3 http://docs.splunk.com/Documentation/Splunk/6.3.1/ReleaseNotes/MeetSplunk This was one of the key things introduced with 6.3 Search Parallelization. Optimized CPU utilization for faster search execution. Index Parallelization. Optimized CPU utilization for faster data ingestion. Read more about the topic and setting here http://docs.splunk.com/Documentation/Splunk/6.3.1511/Capacity/Parallelization and here http://docs.splunk.com/Documentation/Splunk/6.3.1511/Knowledge/Configurebatchmodesearch Hope the helps ... cheers, MuS ... View more