The groups are assigned to each individual index in customers.csv. Think of it as a micro-license for each individual index. You then apply the anticipated daily volume to it and you are off to the races! If you have more than one group using the same index, make a copy of the index definition, put in the new group name, and then adjust each of their percent ownership. Let me know how it works out. Jim ... View more

Hi a212830, Burch is right, this exact feature is built into the Chargeback App. Feel free to reach out to me if you want a walk through, my contact info is in the readme. Jim ... View more

Hi Shaun, This is an interesting problem to solve. I would put "heavy use" customers on their own search head and charge them for that extra hardware. While the searches also impact the indexing tier, it is going to be extremely difficult to charge for that. Depending on the size of your implementation, that incremental cost might not be noticed if it were distributed throughout the company. I'm not trying to promote bad behavior, just trying to determine the feasibility of chasing down the small stuff. Jim ... View more

Check out my Chargeback App - https://splunkbase.splunk.com/app/2967/ ... View more

I have struggled with chargeback since I first started using Splunk in a shared environment several years ago. At first, I tried to charge based on the actual utilization of Splunk, but that is an extremely difficult problem to solve. Then it dawned on me - chargeback the same way that I buy and deploy Splunk. I then focused in on the two main cost factors - licensing and storage. By calculating my run rates for licensing and storage, I am very close to the overall costs. I then wrote the Chargeback App to make my life easier and to share with others. It is well documented, but you can reach out to me if you need more details. I have a 30 - 60 minute talk and demo that I have been giving to customers and just recently at .Conf. When the video is available for that, I will post it here. https://splunkbase.splunk.com/app/2967/ Pay close attention to the "Micro License" that is applied within the App. It puts your greatest fears to rest, "how do you know when someone is indexing more data than was previously agreed to?" I plan to continue development on this App. My next goals are to add in a model for Premium Apps , such as ES or ITSI, as well as account for the hardware within your Splunk architecture. If there is more that you would like to see, contact me. All of my information is in the README file, but you were headed there anyway ;). ... View more

Your best bet is to tell Splunk to always use the first timestamp. You can then build reports around the timestamp field at search time, if that is your ultimate goal. FWIW, Splunk is able to have multiple REGEX per sourcetype. So, you can extract fields from different data formats in the same sourcetype. ... View more

I saw this post and realized that I have not set up my Nest in Splunk yet. I had to set the environmental variable for $SPLUNK_HOME in my profile to get it to work. I also removed all of the PID checks in the script, which did not seem to work on OS X. However, you are not kicking out any errors. Make sure that you have access to the nest index by default under Access Controls. Also, it takes some time before the lookup files are built, so you may just have to look back in after a day. ... View more

Just putting this in as an answer - https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Concurrency ... View more

This can also be expected behavior from your search for instance, this returns 0 of ~500,000 events: index=* | where linecount > 1 | rex field=_raw "(?m)(?P^.*ESTABLISHED.*$)" | search footer If you are still troubleshooting, just start with "index=* startminutesago=5" to see what you have access to. ... View more

I always do this in search before moving it to a .conf file. I think that you want to select one line of a multiline event. This does that and creates a field labeled aaa: ... | rex field=_raw "(?m)(?P^.* Failed.*$)" ... View more

The Splunk App for Windows Infrastructure has most if not all of this covered - https://splunkbase.splunk.com/app/1680/ ... View more

There is no reason that this would ever happen without some sort of outside influence. Some places that I would look: Were changes made to your storage? Verify that indexes.conf is configured properly... http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Indexesconf Search "index=* startdaysago=7" Good luck! ... View more

Glad to see you fixed it on your own. I just wanted to comment so that it did not appear not to be resolved / answered. ... View more

If you cannot change the format of the file, change the field extractions to fit your data. You can do this in props.conf & transforms.conf or use the field extraction utility in the GUI. However, if you are missing some of the fields used to drive dashboard panels, you may have to update some of the searches to pretty up the dashboards. ... View more

I am out of my depth here for Python specifics, but I did find another example Python script - https://github.com/georgestarcher/Splunk-Alert Perhaps the answer is in there? ... View more

The only thing missing from splunk2 is indexer. I believe that this search will list your search peers (indexers), I do not have a distributed env to test on, but it is from the DMC App saved searches: | rest splunk_server=local /services/search/distributed/peers/ Alternatively, just run any search and look at the splunk_server field, which identifies the server where the data lives. ... View more

Hi There, I would try to keep all of the hardware in your indexing their the same. Mixing them will cause weird performance results. The same is true for a SHC. If I were you, I'd just use the new servers in the cluster and tune the parallelization settings. I'd then use the old hardware in a SHC or SHP. You could still hold your legacy data on it if you made them searchable and pulled them out of your forwarders destination. Then just let it age out. ... View more

On a Unix machine, I would just use logrotate. It looks like people have written this functionality in a Power Shell script: http://stackoverflow.com/questions/16795463/using-a-rolling-log-file-within-a-powershell-script-that-gathers-performance-cou ... View more