Hello, Yesterday I noticed that there's a substantial lag in event indexing to the default index (main). When inspecting the processes on my machine, I noticed that a single splunkd process running at 100% cpu. I tried to restart splunk several time, but splunk gets to 100% cpu immediately and stays there. I've opened ticket at [email protected], but no response till now. After deleting the index and re-indexing things got back to normal. 24h later I'm encountering the same problem. The machine splunk is running on has 16 CPUs, 8GB RAM. ~200MB of data is being indexed daily, and there's no significant search activity as well. Will appreciate any help with that. Oren. ... View more

Hello, I'm running a saved search which runs perfectly fine, but when I'm trying to use Report Builder I'm getting a 500 error code with the following message: SearchException: Error in 'eval' command: The expression is malformed. The eval command looks like that: eval r=[search host="myhost" sourcetype="mysourcetype" event="Searches" |dedup user| lookup UserDate user output user_date | eval today=relative_time(now(),"-d@d") | eval yesterday=relative_time(now(),"-1d@d") | eval valid=if(user_date>=yesterday AND user_activate<date,1,0) | stats sum(valid) as s | rename s as search] It looks fine to me, and in light of the fact that it runs perfect, I find it kind of strange that I'm getting such response when trying to use Report Builder. Will appreciate any help with that. ... View more

Hello, I would like to set a real time search which counts events occurred starting from the beginning of the day (12am) until current time. Using the convention of "earliest=-0d@d latest=rt" yielded an error. Any ideas on how to define such window in real time search ? Thanks. ... View more

Hello, I was trying to set a new lookup table, and locate props.conf and transforms.conf, but wasn't able to find the local dir under /opt/splunk/etc/apps/search . Should I simply create one ? Thanks. ... View more

The subsearch documentation says the following: maxout = * Maximum number of results to return from a subsearch. * This number cannot be greater than or equal to 10500. What if choose not to modify limits.conf ? will I still get a result set that isn't greater than 10500 ? What I'm trying to understand is whether a subsearch is limited by default. Thanks. ... View more