Hello, We want to produce correlations between two different (timestamp,value) series. We basically want to plot one value against the other and show the results on a chart. We can get the data we want in a table like this: timestamp,value1,value2 123456789,x1,y1 123456790,x2, 123456800,,y3 ... As you can see in the example above, we can have gaps (nulls) in the data, corresponding to timestamps when either one or the other series does not have a recorded value. Can Splunk fill in those gaps by interpolating the missing values? How? After doing this we would get a table like this: timestamp,value1,value2 123456789,x1,y1 123456790,x2,y2_interp 123456800,x3_interp,y3 ... where x3_interp and y2_interp are values obtained by doing some interpolation on the x and y series (Spline, linear etc). The we would apply "| chart v1 by v2" to see the graph. Cheers, Alex ... View more

Hello, We are having some trouble understanding the disk size requirements for storing our data set in Splunk. The data set: JSON files compressed in zip archives. A json file contains entries like this: {"n":1360799988083479,"v":40118552},... where n is microsecond precision UTC timestamp and v is a value (mostly doubles, longs, ints but can be strings as well). We currently have around 2 TB of such compressed zip archives. Splunk side: The structure of the data allows splitting it in around 100 classes. Because each class corresponds to sources of information with potentially different behavior with respect to the frequency of n/v pairs, we decided to have one Splunk index per class. We did a little investigation with one class. We inserted data with the default Splunk configuration and found that the Splunk index files (.tsidx) were way larger than we expected and were dominated our storage space. We then inserted the same data specifying NO SEGMENTATION and found the Splunk index files (.tsidx) to be much smaller (order of magnitude). We understand that with NO SEGMENTATION we get the most space efficient size on disk at the expense of loosing full text search capabilities. We are fine with this since our data set is fairly structured and we would not use this feature anyway. Despite NO SEGMENTATION lowers our Splunk disk size estimate to 12TB we still feel that 12TB is too large for the original compressed 2TB (See details below). Why is the data in Splunk expanding so much for our data set? Is this normal with Splunk? Is there anything more we can do to optimize this disk space? Cheers, Alex Our disk space estimate is: 500MB compressed data expands to 1.81 GB in Splunk => a factor 4! => our whole data set of 2 TB will be 8 TB. Adding another replica of data (which we estimate to be 4 TB because the journal.gz files seem to be 2x the initial compressed zips) leads to a total of: 12 TB. So we go from 2TB to 12TB. ... View more

Hello, I can get information about the license stacks via the CLI: splunk list licenser-stacks I would like to get the same via a rest API call. Is this possible? Thanks in advance, Alex ... View more