In your Dockerfile you can use wget to download the forwarder and the app. You can have it pulldown the tarball version of the splunk binary and you can unpack it by specifying in the Dockerfile. Then for the app you can download that using wget as well and drop it in the $Splunk_Home/etc/apps folder. Alternatively you can build the image on your machine and copy the app from your local machine. See the official Splunk universal forwarder Dockerfile for inspiration: https://github.com/splunk/docker-splunk/blob/master/universalforwarder/Dockerfile ... View more

How close are the coordinates together? The geostats command groups the latitudes and longitudes into bins for easy visualization. You may have to edit binspanlat and binspanlong attributes to the geostats command to ensure that multiple location don't get consolidated into one because they are close to each other ... View more

The comparison isn't immediately apples to apples. Depending on what you are trying to achieve the stats values command could get you the desired functionality but it also might not The transaction command combines events that share a common field into a single event. Single event is key because the transaction command is what we call a centralized streaming command. In essence, when you see the result the result run the command the results will still be visible under the events tab in Splunk. The options of the transactions command allow you to limit the events grouped together in a certain time span. It will also add an eventcount and duration field. The most important thing to remember is that the entire raw events are combined into a single event by just concatenating them For example: some search|transactions src_ip all the different events with a single src_ip concatenated together. The stats values command is what is known as a transforming command. The result is no longer raw events that can be viewed on the events tabs but statistics that are viewed in a table on the statistics tab. This will just provide a multivalued table entry of a particular field. For example: some search|stats values(src_ip) will give me a multivalue table entry of all the different source ips in the preceding data. The transaction command is a hungry command. So using it depends on your use case. If you seek functionality that is achievable by the stats values command definitely do that but if you really need the functionality of the transactions command then you will have to use it. References: [1] http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transaction [2] http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonStatsFunctions ... View more

maxHotSpanSecs determines how long a hot bucket is open before it rolls over to warm. However, both hot and warm buckets consume disk space. This is the data roll progression: Hot(lives at the specified hot/warm mount point, is able to be written to)------/after maxHotSpanSecs or other config/--> Warm(lives at the specified hot/warm mount point, is read only)----/after maxWarmDBCount/---> Cold(lives at the specified cold path which could be on the same disk as hot/warm or a different one, is read only)-/(maxTotalDataSizeMB)-> Frozen (deleted by default but could be archived somewhere or sent into Hadoop) It sounds like you want to do is hard footprint taken up on disk so I would suggest setting maxTotalDataSizeMB to the maximum amount of space you want that index to take up on disk. ... View more