Add following to end of your search | where tonumber(UsePct)>=90 ... View more

The primaries will be rebalanced after new peer (indexer) joins the indexer cluster but it will not be effective as new indexer doesn't have bucket copies (it'll only have copies of data being ingested after it was added.  To make sure you're distributing buckets uniformly, you should first do the data rebalance after the new indexer is joined, based on the RF/SF you selected. (see https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_cluster_data). This will ensure new peer has almost same number of bucket copies as other. After that manually trigger primary rebalance so that primary buckets. (see this https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_cluster_primary_bucket_copies) https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Rebalancethecluster#Rebalance_indexer_cluster_data ... View more

Give this a try index=tenable* sourcetype="*" severity_description="*" | stats dc(ip) as count by severity_description ... View more

There might not be an efficient way to do that. You'll have to sort your data by srcMsgId (and time) and then use Delta. Or you can use following streamstats version of performing the same. index="bl_logging" sourcetype="testsystem-2" | transaction maxpause=5m srcMsgId Correlation_srcMsgId messageId | table _time srcMsgId Correlation_srcMsgId messageId duration eventcount | sort srcMsgId _time | streamstats current=f window=1 values(_time) as prevTime by subject | eval timeDiff=_time-prevTime   ... View more

Have you updated the inputs.conf on Splunk_TA_vmware and updated the "index=" to appropriate value based on input? https://docs.splunk.com/Documentation/AddOns/released/VMW/vCenterlogs https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts  ... View more

Above search should be working. Is it not working for you? ... View more

Try the updated query above. ... View more

You may not be able to find the forwarder name in all cases. If the data is being forwarded via universal/heavy forwarder and you're not overriding the 'host' metadata, the host would be your forwarder. (index=x sourcetype=y | stats count by host) If the data is being forwarder via universal/heavy forwarder but host metadata is being overridden, and you're forwarding your _internal logs from UF/HF to your indexers, you could find the forwarder name in the metrics log (index=_internal sourcetype=Splunkd component=MEtrics group=per_sourcetype_thruput series=yourSourceType | stats count by host) ... View more

If you're using stand-alone (non-clustered) indexers, Here is the method to rename index (requires backend access and possible downtime). https://www.linkedin.com/pulse/how-rename-splunk-indexes-splunk-mania/ It'll not be considered for license utilization (no re-ingestion). It will keep the same folder structure in new index so no change in warm/cold status. All hot buckets will be rolled to warm as Splunk would be restarted. All accesses to index are managed in authorize.conf so depending upon how your accesses are setup, there may be changes. ... View more

Will following row be included in the result? Will there be any record with just rectype=index?  idx4 hostG Pair4 index   If no, then your logic is correct. In fact, 2nd condition is (below) is not required. (if rectype=lookup, it'll never be index, so it's a deadcode) AND rectype!="index"   ... View more

Have a look at this documentation from Splunk. https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/#Examples ... View more

If you've necessary privileges, you could change the retention period of the index to reduce its size. Just carefully evaluate the new retention and it's impact on data before implementing it (to avoid unwanted data loss). https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Admin/ManageIndexes#Manage_data_retention_settings ... View more

Give this a try Your current search with field index host pair rectype | eventstats dc(rectype) as rectypes by index pair | where NOT (rectypes=2 OR (mvcount(rectype)=2 AND isnotnull(mvfind(rectype,"(index|lookup)")))) ... View more