See here: http://splunk-base.splunk.com/answers/53866/filter-duplicate-windows-events You could perhaps try to find a way of removing duplicates before Splunk indexes the events... Not sure this is feasible and adds a lot of complexity. If storage/licensing isn't a issue you can index everything and use transactions for reporting purposes. It will group the duplicates together so you are only counting 1. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction ... View more

Best practice is to install the universal forwarder for anything related to Windows event logs. We went through a painful experience by not following this practice. It has a really small footprint and should not affect sever performance. The forwarder also brings with it numerous benefits as opposed to syslog. Metrics data being one that we leverage quite extensively. it allows you to monitor data sources in a uniform way to determine last event indexed, kbps thruput, eps, etc etc It also allows you to use the deployment server to centrally manage forwarder configs which is very very handy. combined with the deployment monitor app and you've got a robust enterprise grade implementation. So yes... use the forwarder wherever possible and syslog for other "stuff". http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdata ... View more

It will always show the date/time of your primary search. Not the subsearch. Splunk has no built in support for plotting against multiple axis. ... View more

http://docs.splunk.com/Documentation/Splunk/latest/Developer/AdvancedCharting From the docs: For performance reasons, the JSChart module truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration. I switch to using the FlashChart module instead and now everything works 100%... ... View more

I don't think what your suggesting is possible. Splunk doesn't display graphs as images. In the 4.2 & previous versions it was a flash component and that has now been replaced by javascript in 4.3 I had a similar requirement and eventually decided to use the REST API to fetch data and generate the graphs & docs. Works like a charm. The Python (or Java/JavaScript) SDK which handles communication with Splunk makes this pretty easy to accomplish. Combine that with matplotlib (http://matplotlib.sourceforge.net/) and you've got a robust solution. http://docs.splunk.com/Documentation/Splunk/latest/Developer/RESTIntro https://github.com/splunk/splunk-sdk-python ... View more