Since you don't know Python, I'm going to give you some sample code to change the pingstatus.py count=1 if len(sys.argv)>1 and len(sys.argv) != 4 and len(sys.argv)!=5: print "Usage |pingstatus url as <local-field> (or have url field name in da\ ta) <optional-count>" sys.exit() elif len(sys.argv) == 4: urlfield=sys.argv[3] elif len(sys.argv) == 5: urlfield=sys.argv[3] count=sys.argv[4] That will get you your count argument as a number added to your pingstatus command. Don't use count=5 as input as you'll have to parse that. Just put in 5. For example: |pingstatus url as ip 5|table ip pingstatus* Next, for the pingdelay field, you can use this approach. if urlfield in r: for i in range(1, count+1): try: delay = ping.do_one(r[urlfield], timeout=2) if count=1: r["pingdelay"] = delay continue: else: pingdelay="pingdelay" + str(i) r[pingdelay] = delay except socket.error, e: if count=1: r["pingdelay"] = 10000000 else: pingdelay="pingdelay" + str(i) r[pingdelay] = 10000000 This will will created fields pringdelay1, pingdelay2, etc if your count is greater than 1. This has not been tested, so you'll have to play it. Also, don't just copy and paste from this answers post as the formatting may be wrong. In Python, proper indentation matters. In Splunk to print your results, do: |table pingdelay* As for Windows vs Linux, I'm not sure why this is different as I used a public domain ping.py program to get my results. For Windows you may have to find a version that is better suited for it. Keep in mind this is a reference implementation to get you an idea how to do this. It is used as is. ... View more

See the timechart command in the Splunk docs. index=blah host="blah" "Error" |timechart count There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d) ... View more

Why use a heavy forwarder? Could you not use an Universal Forwarder which scales better? You may try to use maxthruput in limits.conf to -1 to not throttle it at all. Also, you could also set up multiple forwarders on the same machine (make sure they listen on a different port) and each one can monitor, say 2 queues, at a time. That way, you'll have more listeners. Each forwarder can be configured to send to more than one indexer (auto load balance) and that may also help you scale. ... View more

BTW, this has nothing to do with automatic simple XML Dashboard (the tag you added for this question), as that add-on is used to generate timecharts from a simple CSV file definition to quickly get trending dashboards. Anyway, here's how you may debug your search. Make it simpler to test: index="abc" (source="tac.log" DebugLevelSrc=xxx "ccc") |replace "tac.log" WITH "QA Log" in source | stats count by source If that works in search and doesn't work in dashboards, then, click on the little i in the panel for inspect in search (there is also an option to open in search) to see what search is run behind the scenes. If that search works in "open in search" and not in the the dashboard, then, you may want to contact support. ... View more

First, you need to start Splunk as root or sudo root as it can't call the ICMP protocol without root (or administrator on Windows) access. If you have done that, then your next step is to change your search. I used a default name called url as the ip field to search on, which is my mistake. I should change that to ip as that would be more appropriate. I copied some of the add-on from another add-on (httpstatus), so that's why there is the legacy name. To get around that, since you don't have a url field name in your data, use this as documented in the README.txt. sourcetype="test_data" | dedup ip | pingstatus url as ip| table ip,pingdelay (That would be equivalant to this below, but in that case you lose your ip field name: sourcetype="test_data" |dedup ip | rename ip as url |pingstatus| table url, pingdelay ) ... View more