yeah the image wasn't there... ... View more

I would add the following: Identify the type of architecture your splunk environment contains(standalone, distributed, indexer clustering, search head clustering, premium apps(ITSI/ES/etc)). Read the Known Issues for the version you are planning to upgrade to. Read New Features for the version you are planning to upgrade to. Confirm your apps are compatible to the version you upgrade to. If possible test the upgrade in a replicated "dev" environment to ensure functionality of all your apps/add-ons/etc. Review functionality changes for new versions + outdated configs. Backup your data. Standalone: https://docs.splunk.com/Documentation/Splunk/7.2.6/Installation/HowtoupgradeSplunk Distributed: https://docs.splunk.com/Documentation/Splunk/7.2.6/Installation/UpgradeyourdistributedSplunkEnterpriseenvironment Indexer Cluster: https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Upgradeacluster Search Head Cluster: https://docs.splunk.com/Documentation/Splunk/7.2.6/DistSearch/UpgradeaSHC ... View more

status=2 is evaluated as "Unstable" and can only be triggered by the following two conditions. There is a time skew between the SH and Search Peer. The indexer is oversubscribed and rate at which it returns results is inconsistent with the other search peers. ... View more

Usage is a blanket counter which increments whenever something is indexed. RolloverSummary is a tall(sum) of the days usage which is calculated just after midnight. There is likely a discrepancy with the time period searched leaving a gap between the summary evaluation and the time period beginning/end. ... View more