Started a google drive where people can put in their data from testing. Included prepatch data for part of our deployment. Anyone is free to deposit their own data https://drive.google.com/drive/folders/1LegN7VuOA9y8VHY5D7XjARhvVpBaciz1?usp=sharing ... View more

Why cant you put them in two different panels on the same row? ... View more

Best thing to do is to move them onto the thawed path and manually delete them when the time comes, keeping them in the default path can be tricky to get working, where as thawed it will usually be fine. We are having the same issue moving from standalone indexers to clustered indexers, we did the above and let it ride until our retention period was complete. ... View more

If you wanted to be really clever, you could create iframes for each single value field. Then put in an HTML panel with the iframe dimensions. Its how i have done it in the past. Makes it a pain to manage when you need to update something, but gets the job done. ... View more

When using list in a triggered alert, it creates "sublines" inside of a true single line. I would be like going in Excell and hitting Shift+Enter in a cell. Have you tried doing the following just for the alert? stats count(cm) as Message by logdata.machineName, logdata.projectIdentifier | (your rename statement) ... View more

Configs pertaining to an index in a cluster should always be deployed out in the same file, or along side it in a joining file. Example: App 1: IDXCluster_VolumesRestrictions_ALL Contains volumes, default path location, default retention period (indexes.conf) App 2: IDXCluster_Indexes_ALL Contains index names, paths, custom retention (indexes.conf) Remove any index configurations from your index cluster etc/apps* or etc/system/local* ... View more

What version of the Unix app are you using? Check the searches powering the tab and see what index its referring to. ... View more

Not with the current versions ... View more

Try this |inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY ... View more

You should be more than fine with going with 5 servers at 1200 SAS. A good rule of thumb is to go 1 server, 8 cores, 8 GB ram, and 1000 IOPS per 100GB daily data. Do you actually index all 500GB/day ... View more

Try not setting the timestamp format and line breaking to see if the data appears. Then add configurations one at a time until you find the broken one/ James ... View more

Hello, $SPLUNKHOME$/etc/system/local/distsearch.conf This should contain the following: servers = IP:PORT,IP:PORT,IP:PORT ... View more

Run it again without the | fields in your append. The | field means you are not transferring the time field from the timechart, you are just transferring the data field. ... View more