Nope, you got it right. Thanks ... View more

Hi Martin, I'm looking for something similar, whereby i've a device that keep sending Lat/Lon data every 30s. And I've user to input Lat/Lon and radius and marked as their respective Geofencing. Based on what you suggested, how can i write a search that will identify and trigger a alert whenever the device enter the specific zone. I'm aware there is a new app "Shapester" but i don't really know how to use that app or write a search to identify whenever a device enter the specific zone. https://splunkbase.splunk.com/app/2893/#/documentation Appreciate your input on this ... View more

I need to play with things on something other than my phone to get the syntax right, but you probably could have 2 subsearches to define earliest and latest for the parent search. You'd likely use addinfo to help drive based on the selected timeframe. Possibly [|noop|stats count|addinfo| eval latest=relative_time(info_max_time,"+2d") | fields latest] [|noop|stats count|addinfo|rename info_max_time AS earliest|fields earliest] ... View more

The data model storage path/tstatsHomePath for all indexes by default points to volume:_splunk_summaries/$_index_name/datamodel_summary so it's just a matter of changing the storage path of the _splunk_summaries volume: My preferred way of changing the default behaviour is the following: In $SPLUNK_HOME/etc/system/local/indexes.conf: [volume:_splunk_summaries] # 60 GB maxVolumeDataSizeMB = 60000 # Preferred partition for summaries path = /splunk_summaries This way you change the default location of the _splunk_summaries volume out of the Splunk home dir and you won't have to change it per index. If you want more granular control per index you'd have to change tstatsHomePath for each one as stated in the other answer. ... View more

You can do it without a subsearch at all. This looks a little inelegant, so it can probably be coded a bit tighter, but here's some unlimited code that ought to get you the same result as yours... (index="video" article_id!="") or (index="page" article_id!="" type=d) | table index article_id type platform | fillnull value="" type platform | stats count as itemcount, list(platform) as platform, list(type) as type by article_id index | eval platform=if(platform="",null(),platform) | eval type=if(type="",null(),type) | eval itemcount=if(index="page", 0,itemcount) | stats sum(itemcount) as itemcount, list(platform) as platform, values(type) as type by article_id | search type=d | stats sum(itemcount) as count, by platform The above is based on the assumption that your video records (effectively) contain three fields - index=video, article_id=somevalue, and platform=someothervalue (no type). Likewise, your page records contain index=page, article_id=somevalue, and type=d (no platform), and that you only want records from video when the article_id is on a type d record in the page index. ... View more