hey guys, what is a good threshold to set for the splunkd process on indexers and syslog forwarders? we are finding that cpu utilization has been slowly creeping up to about 15%.. is this normal? concerning? how can this be reduced? thanks! ... View more

hey guys, i am pretty sure we have something in place which is stripping the hostname from the fqdn. just cannot figure it out. for example host=ab12345.domain.com gets stripped and when searched only shows host=ab12345 we have a few thousand hosts that are coming in fine, however a handful show up WITH fqdn when i make a search. why would only a few hosts be showing with fqdn when 99% are showing in search fine. background: we have a host data coming in from ucmd via lookup thanks ... View more

I lose my field extractions when I add a search parameter to my search: THIS WORKS: (I see fields on the left hand side that i have setup in the base app via the props/transforms config) index=myindex host=62643 OR host=62644 OR host=62645 THIS DOES NOT WORK: (I lose all my field extractions when I run the search below) index=myindex host=62643 OR host=62644 "ProcessGroupID=CLPORT&Action=T" btw: processgroupID is not an extracted field.. is that why I lose my configured fields when I try and free form search? thanks! ... View more