Wow. I would have never come up with this: | foreach * [| eval "<>"=100-'<>'] Worked perfectly. Thank you! ... View more

Ok, thanks. You've confirmed what I believed to be the answer. Although I run Win-64 Splunk on other systems, in this instance it needed to be 32-bit Linux. Oh well... ... View more

That does provide a lot of good info. I don't think it has what I'm looking for though. Here's what happened in my case: User writes a very resource intensive query and launches it. When it they see it's going to take a REALLY long time, they change the query slightly and then launch that. Repeat that process a dozen times. When I find out things are going sideways, I log into the search head and see the queries running and realize what's going on. Here's the weird part... Even when they all show complete (or killed) under activity, I still have massive disk i/o on the indexers that lasts for awhile longer. So, what I really want to see is what's happening on the indexer during this time. The DMC will show me that it's getting hammered, but I don't think it will show me the hammer, and a way to potentially kill it, if that's even possible. I ended up restarting Splunk on the indexer to kill it. ... View more