Well like a said before when you summary index data it is new data that has been indexed so it will have a new host, source & sourcetype assigned automatically. You can either just use a different field instead of sourcetype from your events, or put a new value into the existing sourcetype field using an | eval statement assignment. ... View more

So yes summary indexing will create a new host, source and sourcetype field for that data that has essentially been newly indexed into the summary index you just created. You can either just use different field names for the host, source and sourcetype fields (i.e. orig_) or remap them using the option under the Summary Indexing in the UI. I've always found the best way to validate and test a new index is to use the | collect command to ensure everything looks OK before setting up the job. The Summary Indexing option in the UI really just uses that | collect command anyway. Check out the docs for more info: http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing ... View more

In versions of Splunk lower than 7.0 the same function can be achieved with the summary indexing option (located towards the bottom of the page, below Alert actions) this will send the events from your search into a new summary index. Optionally you could also you the | collect command and achieve the same result. Just be sure when you are storing data into a summary index it matches the format that you expect 🙂 ... View more

Perhaps you could you use a subsearch to find the data you are interested in | fields x and then pass those to the outer search? ... View more

Do you mean you want to log new events into a summary index or you want to track that the report completed it's schedule? ... View more

You could always put a | head 8 command in the mix to restrict it to the first 8 results of the lookup file. ... View more

SummaryDirector processes are around the maintenance activities that Splunk runs in the background around search cache and summarization needed to ensure buckets and search are processed. Most of this is defined in the limits.conf.spec file for more background. There is another good answers post on some of this here as well: https://answers.splunk.com/answers/123443/indexers-with-large-number-of-indexes-becoming-unresponsive-because-of-acceleration.html ... View more

Are there any errors in the log & can you send email from that search head alone? Try sending an email via telnet (https://mediatemple.net/community/products/dv/204404584/sending-or-viewing-emails-using-telnet) and see if you get an error. It might be ACL related or with the mail relay. ... View more

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group. there is a good write up here on the ttl https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for-a-saved-search.html ... View more

a restart of the forwarder will force a check. Just make sure your deploymentclient.conf is set correctly. ... View more

I believe the add-ons come as part of the package - check the /opt/splunk/etc/apps directory and see what's in there? ... View more

if you are using FQDN and the hostnames are logical per domain you can do something with the SOURCE_KEY? SOURCE_KEY = metadata:host REGEX = <something> DEST_KEY = <something> FORMAT = <something> ... View more

kind of...you basically have millions of events with the same date/time stamp which is causing an logical error in Splunk as to how many events it can process per second. (see http://splunk-base.splunk.com/answers/2958/error-in-indexscopedsearch-the-search-failed for very good explanation) This is usually related to a bad time date stamp logic in a props.conf somewhere that isn't breaking the events down correctly. ... View more

A Splunk setup can be distributed so that your search heads (the GUI that you run your searches through) and the indexers (what crunches the data) can be separated out. It can also be an all-in-one solution that does both. The Splunk App for NetApp ONTAP has 2 main components: It has a search head app. This is the GUI side and has the dashboards you use to view the data. This get's downloaded from http://splunk-base.splunk.com/apps/67764/splunk-app-for-netapp-ontap and can be installed through the manager/app section on the search head Splunk_TA_ONTAP7 is what is called a Technology Addon - it supplies the indexing logic needed to make the data collected (in this case from the NetApp) searchable and useful for the dashboards. It has the props.conf and transforms.conf that are needed to manipulate the data. In a distributed environment this would sit at the indexer, but in an all-in-one solution it can be installed within the apps directory as well. You need both of these to make the application work correctly. ... View more

I think you may be able to use a summary index for this instead of all these lookups? You could have multiple searches feed the available data into a larger index and then customize your report to run off that data with the fields you need already set. ... View more