Hi, I am writing a search: timechart span=1h sum(Bytes) AS "MBytes " In the same search, I want it to return Mb instead of bytes ie. bytes/1000000. So I tried: stats sum(eval in_mB =Bytes/1000000) as "MBytes" But just eval in_mB =Bytes/1000000 works. Can I store this as a column for future use instead of rewriting it? How do I do it? ... View more

Hi... I want to create an app in splunk to store the configs that would make my forwarder pick data from a location. I read the create deployment app document in splunk, which talked about creating a directory in dplunk_home. I find that the splunk web has a create app option... Is it not easy to do it that way? What is the difference between both? ... View more

I want to create an app with forwarder and index configurations and push these configs to collect data from a particular location regularly. Any videos or materials to help me do this? I need step by step help... ... View more

Hi.. I was used to using splunk as a single instance in my laptop. I am new to forwarders and indexes. I have log data in the form of csv files available(with headers) . Assuming data is in /abc/data_files and splunk forwarder files are in /abc/splunkforwarder/etc/system/local. In the local I only find these files deploymentclient.conf, inputs.conf, outputs.conf, README, server.conf. When I opened inputs.conf and outputs.conf I found them to be empty. How do I make the forwarder to pick the files from the location and start loading the data. How do I create a new index so that I can handle the data better. Why is there no props.conf file? Dont I need it? Why are the other files empty? I do not know if I am even in the right direction in wanting to make changes in the forwarder. I am really lost. Please consider me to be a beginner. Please let me step by step or point me to a document to figure out how to do this? ... View more