I am using the Splunk App for Web Analytics where each app searches using data models with summariesonly=t by default. However, it's not working as it is. However, when I remove summariesonly=t from the search, it starts working. Someone please help me to understand where do we use summariesonly=t with datamodel? ... View more

Hi, All reports by default are not using an index in searches. However, I am using my specific index where all data is stored. How do I point all reports to my index by default? ... View more

Hi, I am planning to migrate from my single indexer to dual indexer clustering. Here we have two ways to do that: 1) Ask the forwarder to switch between two indexers in 30 seconds. Search Head will merge data from two indexers. 2) Distribute indexes in two indexers like index=OCSPROD in server1 and index=EBIZPROD in server-2. Configure forwarder to send logs to a specific indexer without switching between two. Here my question is, which would be the best performance wise for search & reporting? ... View more

Hi, I am looking for a list of the most searched indexes and the count for each. Is it possible to get that in Splunk? Can someone please share a search for that? ... View more

i have userAgent field that i am planning to extract using useragent app. However i am getting below exeception . error : Script for lookup table 'user_agents' returned error code 1. Results may be incorrect. My search query is : index = node | lookup user_agents userAgent Events in which userAgent field is there : {"sourceIP":"10.242.193.56","userAgent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36","origin":"http://customer.wm.com","payload":{"app":"customer-search","timestamp":"2015-07-31T19:34:29.755Z","log":{"results":0,"query":"shashin k"}} ... View more