I'm using summary index to capture all previous days and regular index to capture today's data to improve performance. I'm taking the earliest & latest timestamp of regular index.. Timerange token is added. Now i want to set a token for SIearliest & SILatest using regular index timestamp. eg: if searching for last 7days, instead of "+6days" i need a variable which should automatically check and change when i search for last 30days next time. |eval SIEarliest = $time_range$ (earliesttimestamp) +) |eval SILatest = $time_range$ + ) my search: index=regular sourcetype=ABC | chart earliest(_time) as RIEarliest latest(_time) as RILatest |eval SIEarliest = $time_range$ + relative_time(now(),"-6d@d") |eval SILatest = $time_range$ + relative_time(now(),"-d@d") | appendpipe [ stats count | eval EarliestTime=0 | eval LatestTime= 0 | where count=0 | table RIEarliest RILatest SIEarliest SILatest ] ... View more

i have created a dashboard with 6 panel's, with last 7days time frame (from today) for transaction's count between the A-b, B-c, C-D applications, daily more than 1lakh + transactions are flowing, no i want to use summary index for improving the performance. As summary index run's fast searches, My requirement is, i want to use the regular index for capturing today's data and for last 6 days it should capture the data from summary index. Please help me with the queries and commands which i can use. ... View more

I want to create report for last 7 days data, which should take last 6 days data from the summary index and for today's data it should take other index, by Switch Indexes. is there a possibility? ... View more

i'm trying to remove field from the timechart panel eg: index=os host=xyz | timechart avg(usedMB) as DiskUsed avg(freeMB) as DiskFree avg(sizeMB) as DiskTotal by host |evalDiskUsed = round(DiskUsed/DiskTotal*100) | fields - DiskFree, DiskTotal when i execute the above search, i see visualization DiskFree, DiskTotal too towards right end of the panel.. i want to see only DiskUsed.. How do i remove DiskFree, DiskTotal values.. help with the search.. ... View more

i have created a dashboard with 12 panels.. 6 panels have capacity metrics 6 have performance metric now i want to differentiate them in one single dashboard.. under {Capacity} 6 panels under {Performance} 6 panels ... View more

I'm trying to create a drilldown for a single value panel, when i click on the value it should take me to new window. its splunk 6.2.2 version ... View more

Do I need to reboot the server after I install Splunk agent?? I have few servers which doesn't have agent installed now i want to install the agent on those servers. will it ask me for reboot??? Yes or NO... ... View more

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard? ... View more