Brilliant, thanks, would be helpful if splunk actually said what the problem was rather than just failing with Error=None ... View more

Is it not working or can you just not get to it? Check that your server is actually listening on port 8000, if it isn't something has gone wrong (check the splunkd.log file for clues). If splunk is up and listening on port 8000, it may be that you just can't get to it from where you are, what message does the browser give? If it just hangs and fails to load, it could be a firewall blocking you, if you get something like could not find server, it may be DNS related. ... View more

If you want to re-index the same file, you can use btprobe to reset the fishbucket for that file so that it is re-sent by the forwarder: E.g. Stop splunk on the forwarder Run: ./splunk cmd btprobe -d /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db --file /home/ec2-user/aaa/aaa_20181004.csv --reset Start Splunk You should find that the forwarder will re-send the file for indexing. ... View more

Yes, i get you, I guess then you'd have to use streamstats instead then with a defined window size. I'm not sure how you'd go about accounting for more than one missing value though... ... View more

You could use the eventstats command to calculate the averages for each of the values that you are interested in, this adds the value as a new field to every event. Then you could use the coalesce function to fill in the empty values with the average values calculated using eventstats, like this: | eventstats avg(cpu_time) AS avg_cpu avg(disk_read_time) AS avg_read avg(disk_write_time) AS avg_write | eval cpu_time=coalesce(cpu_time,avg_cpu) | eval disk_read_time=coalesce(disk_read_time,avg_read) | eval disk_write_time=coalesce(disk_write_time,avg_write) | fields- avg* ... View more

Yes, this is possible (we have moved data both in and out of Splunk Cloud before) but you will need to engage professional services to do this as with Splunk Cloud you have no access to copy the data onto the indexers yourself. In our case the data was copied to an S3 bucket which you make accessible to your Splunk Cloud environment, then pro-services will work with cloud ops to copy the data to the indexers to complete the migration. The biggest thing you will need to plan for is how much data you have to transfer to S3, if it's a relatively small amount and you have fast upload speeds, you may be able to upload direct, if you have a lot of data and/or insufficient bandwidth to copy the data in a reasonable time, an Amazon Snowball may be a viable choice. ... View more

I've just had exactly the same issue, and a restart of splunk fixed it, not 100% sure why. ... View more