I tried taking a look at this question: https://answers.splunk.com/answers/395258/how-to-specify-different-time-ranges-for-each-pane.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev However, the solution didn't work. I have a basesearch that I want the whole dashboard to use, and I grab the data over a week period. But I want some panels to only display an hour's worth of data. However, they just reset to showing the whole week's worth of data instead. Here's part of my dashboard. <dashboard> <search id="baseSearch"> <query>index=salt source=/var/log/salt/master Published command details NOT find_job</query> <earliest>@w0</earliest> <latest>now</latest> </search> <label>Salt Today</label> <row> <panel> <title>Jobs Run Today</title> <single> <search base="baseSearch"> <query>stats count</query> </search> <earliest>@d</earliest> <latest>now</latest> </single> </panel> Any ideas? ... View more

Often times, we are tasked with deleting data out of an index to trim it down. Generally, we do this by setting the frozenTimePeriodInSecs and allowing Splunk to remove old data. However, before we do that, we need to figure out where the best bang for the buck is. Many times people just ask us for the oldest event and try to plan it around there, but this is usually a very small bit of the data ( some old remnants of events that somehow got indexed way later ). In order to figure out what the earliest time is that there is a large chunk of data at, we've been doing something index=myindex | timechart count span=1w And running that across All Time. The problem is that it's slow, especially for our bigger customers, who are often in the 1 billion event range for a few months of data. Plus, we're just doing event counts, rather than getting real sizes of the data ( or even the compressed on disk size ). I've played with using len(_raw) and summing it up, but it just made things even slower. Is there a quicker way to do this? I've played with dbinspect but that doesn't give the breakdown we'd need. I've also thought about doing this as an ongoing search with a scripted input that runs daily to get the index sizes on disk, but I realized that this doesn't give us a picture of what Splunk looks right now. The second we delete any data, all that historical data becomes obsolete. Ideally, I'd like to get a current size of index, per index/per day. Anyone have any ideas? ... View more

Can't seem to get this to work using whitelists in inputs.conf I have a location I need to monitor for several log files across several directories, all of the same type: This works: [monitor:///var/disys/phoenix1a/jboss/cbs2-V*/default/logs/*.log] disabled = false sourcetype = cbs2 However, this doesn't: [monitor:///var/disys/phoenix1a/jboss/cbs2-V*/default/logs] whitelist = \.log$ disabled = false sourcetype = cbs2 Am I doing something wrong here? The white list seems rather simple and it seems like it should work just fine - however, none of the logs are getting sent. ... View more