You are welcome. If this answered your question, please mark the question as 'solved' for posterity. THANKS! ... View more

Here's one approach:   | inputlookup records.csv | eval status=if( (condition1="noncompliant") OR (condition2="noncompliant" AND condition3="noncompliant" AND condition4="noncompliant"),"NC","C") | stats count(host) by status     BTW, you don't need a  stats count(host)  because you are just counting records, so  stats count would also work.   ... View more

FYI: Looks like docs have been enhanced to link to the relevant topic. Please carefully read the docs on limitations with backwards compatibility. Buckets created with, for example, tsidxWritingLevel=4 cannot be read by versions that don't support that level. ... View more

Try this:  |inputlookup change_task_xx| rex field=approval "\n(?<name>.+)\sapproved\s.+for\sgroup\s(?<group>.+)\n"|table change_request name group   ... View more

So, in general, the column width in the Search and Reporting app does not adjust to the length of the largest value; whether that's a string field, a numeric field, or a sparkline. There is that. Secondly, the length of the sparkline depends on the number of data values which in turn depends on the search timeframe (i.e. total events). How much time a single sparkline point spans is chosen depending on your search timeframe unless you explicitly specify it. If you choose a large search time frame with few results you get a shorter line than if you are running a short time frame search. Try this:    index=_internal earliest=-60m | stats sparkline(count,30s) as SparkLine, count by sourcetype | fields SparkLine, sourcetype, count   This is going back 60 minutes and the counts for the sparkline span 30secs each. That results in 120 "bins" and a reasonably long line. If you change the sparkline span to 30mins, you'll get two data points, and a short sparkline.  Sparklines can display a maximum of 101 data points. If you have enough screen width, the space will be divided amongst columns evenly, so you'll end up with extra space for column values that cannot use it. If you run this:    index=_internal earliest=-200m | stats sparkline(count,2min) as SparkLine, count by sourcetype | fields SparkLine, sourcetype, count, "AAAAAAAA", "BBBBBBBB", "CCCCCCCC", "DDDDDDDD", "EEEEEEEE"   you may see that your sparkline fills the -now smaller- column width out better. HTH! ... View more

Please refer to this for a command that scopes a rebuild to a whole index.  My assumption is that all buckets still lifecycle-managed by Splunk (which is true for COLD) will be subject to cluster master fixup to meet RF/SF, but you will have to run the rebuild on every peer in your cluster (while it is taken OFFLINE), so - in theory - RF should still be met and full index rebuild will happen as needed as part of normal cluster operations.    ... View more

Splunk Validated Architectures (SVAs) are proven reference architectures for stable, efficient and repeatable Splunk deployments. Many of Splunk's existing customers have experienced rapid adoption and expansion, leading to certain challenges as they attempt to scale. At the same time, new Splunk customers are increasingly looking for guidelines and certified architectures to ensure that their initial deployment is built on a solid foundation. SVAs have been developed to help our customers with these growing needs. Whether you are a new or existing Splunk customer, SVAs will help you build an environment that is easier to maintain and simpler to troubleshoot. SVAs are designed to provide you with the best possible results while minimizing your total cost of ownership. Additionally, your entire Splunk foundation will be based on a repeatable architecture which will allow you to scale your deployment as your needs evolve over time. 
SVAs offer topology options that consider a wide array of organizational requirements, so you can rest assured that you will find a topology that is right for you. The Splunk Validated Architectures selection process will help you match your specific requirements to the topology that best meets your organization's needs. If you are new to Splunk, we recommend implementing a Validated Architecture for your initial deployment. If you are an existing customer, we recommend that you explore the option of aligning with a Validated Architecture topology. Unless you have unique requirements that make it necessary to build a custom architecture, it is very likely that a Validated Architecture will fulfill your requirements while remaining cost effective. You can find SVAs here. ... View more