Hi there, Ive expanded the data age vs frozen age dash into search and want to get an overview of the whole platform listing each index with its oldest data etc. | rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes/ | join title splunk_server index type=outer [| rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes-extended/] | eval bucketCount = coalesce(total_bucket_count, 0) | eval eventCount = coalesce(totalEventCount, 0) | eval coldBucketSize = coalesce('bucket_dirs.cold.bucket_size', 'bucket_dirs.cold.size', 0) | eval coldBucketSizeGB = round(coldBucketSize/ 1024, 2) | eval coldBucketMaxSizeGB = if(isnull('coldPath.maxDataSizeMB') OR 'coldPath.maxDataSizeMB' = 0, "unlimited", round('coldPath.maxDataSizeMB' / 1024, 2)) | eval coldBucketUsageGB = coldBucketSizeGB." / ".coldBucketMaxSizeGB | eval homeBucketSizeGB = coalesce(round((total_size - coldBucketSize) / 1024, 2), 0.00) | eval homeBucketMaxSizeGB = round('homePath.maxDataSizeMB' / 1024, 2) | eval homeBucketMaxSizeGB = if(homeBucketMaxSizeGB > 0, homeBucketMaxSizeGB, "unlimited") | eval homeBucketUsageGB = homeBucketSizeGB." / ".homeBucketMaxSizeGB | eval dataAgeDays = coalesce(round((now() - strptime(minTime,"%Y-%m-%dT%H:%M:%S%z")) / 86400, 0), 0) | eval frozenTimePeriodDays = round(frozenTimePeriodInSecs / 86400, 0) | eval frozenTimePeriodDays = if(frozenTimePeriodDays > 0, frozenTimePeriodDays, "unlimited") | eval freezeRatioDays = dataAgeDays." / ".frozenTimePeriodDays | eval indexSizeGB = if(currentDBSizeMB >= 1 AND totalEventCount >=1, round(currentDBSizeMB/1024, 2), 0.00) | eval maxTotalDataSizeGB = round(maxTotalDataSizeMB / 1024, 2) | eval indexMaxSizeGB = if(maxTotalDataSizeGB > 0, maxTotalDataSizeGB, "unlimited") | eval indexSizeUsageGB = indexSizeGB." / ".indexMaxSizeGB | eval indexSizeUsagePerc = if(isNum(indexMaxSizeGB) AND (indexMaxSizeGB > 0), round(indexSizeGB / indexMaxSizeGB * 100, 2)."%", "N/A") | eval total_raw_size = coalesce(total_raw_size, 0) | eval avgBucketSize = round(indexSizeGB / bucketCount, 2) | fields title, splunk_server, freezeRatioDays, indexSizeUsageGB, homeBucketUsageGB, coldBucketUsageGB, eventCount, bucketCount, avgBucketSize | rename splunk_server as "Indexer" freezeRatioDays as "Data Age vs Frozen Age (days)" indexSizeUsageGB as "Index Usage (GB)" homeBucketUsageGB as "Home Path Usage (GB)" coldBucketUsageGB as "Cold Path Usage (GB)" eventCount as "Total Event Count" bucketCount as "Total Bucket Count" avgBucketSize as "Average Bucket Size (GB)" I have the index name etc listed, but how do i group all the indexers so that the indexes are not split by each indexer, but rather just one "overall" view by index? Thanks! ... View more

Hi there, I have 2 forwarders on a single box - one HF one UF. I want to switch off the UF. Im looking for a list of sourcetypes that the UF is sending. Does anyone have a search that can tell me what sourcetypes are actively sending data to Splunk via the UF's GUID ? Thanks!  ... View more

Hi there, Does anyone have a search that can show me what data was forwarded and ingested by which port?We have multiple ports set up in our environment and id like to monitor what sourcetype is being ingested, how much, and by which port. Thanks!  ... View more

Hi there, How can I stop all-time searches from running in the environment either via users or dashboards? Running 7.3.3 so cant take advantage of WLM monitoring yet. Can this be done with search restrictions and roles, in the sense that the search just wont run? Thanks! ... View more

Hi there, How can i get my _internal logs from my Fargate instance of Splunk? Ideally get them sent to CloudWatch or get a copy of them off the instance to a different location? Thanks! ... View more

Hi there, I have a dropdown input and a multiselect input. I want whatever I select on the dropdown to be "added" to the multiselect input. EG - if i select car type "Tesla" from my dropdown - i want it to then say "Tesla" in my multiselect. If i go back to the dropdown and select "ford", i want it to add that to the multiselect as well - so in the multiselect i would then have both cars listed. Anyone know how to achieve this with tokens? Thanks! ... View more

Hi there, I have a dashboard with 3 dropdown inputs and a text box. I am trying to get whatever i select from the 3 dropdown boxes to appear in the adjacent text box, essentially just appending the tokens to the whitespace and only running when they appear in that box and i hit "submit". The selections from the dropdown need to be in " ". I also want it to then clear previous selections if i go back and change one of the dropdowns again. Has anyone got any thoughts on how i could achieve this? Currently this almost works - i just need to figure out the append part properly: <fieldset submitButton="false"> <input type="dropdown" token="mainSection"> <label>Main Section</label> <fieldForLabel>MainSection</fieldForLabel> <fieldForValue>MainSection</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | fields MainSection | dedup 1 MainSection</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="subSection"> <label>SubSection</label> <fieldForLabel>SubSection</fieldForLabel> <fieldForValue>SubSection</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | search MainSection="$mainSection$" | fields SubSection | dedup 1 SubSection</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="dataLine"> <label>DatalineName</label> <fieldForLabel>DatalineName</fieldForLabel> <fieldForValue>Dataline</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | search MainSection="$mainSection$" | search SubSection="$subSection$" | fields DatalineName Dataline | dedup 1 DatalineName</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <eval token="chosen_dls">$chosen_dls$." ".$dataLine$</eval> </change> </input> <input type="text" token="chosen_dls"> <label>selected</label> </input> Thanks! ... View more