Hi Folks,   We have 40k+ clients reporting to one DS due to which we see a performance degradation on Splunk DS. As Per best practice i see we should not have more than 10K clients reporting to one DS. Please suggest a way forward on this. Do we need to have one more seperate DS and divide half of the clients or any specific solution in this scenario?   Thanks  ... View more

Hi Folks, I am getting below error in the incident review dashboard and this error is persistent impacting operations. Error: only 0 events successfully updated. unable to edit all selected events due to the max events per bucket limit. I tried increasing max_events_per_bucket to 2500 referring below link even though the issue is still persistent.  https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR Please suggest. Attached below screenshot Thanks in advance   ... View more

Hi Folks,   I am been trying to display latest time results. I have a logs where time stores under a custom field (Patch_date) and i want to display latest time result. I tried below but that doesn't worked, base search |search Patch_date=latest(Patch_date) |table Patch_date,region,server,os_type,location base search |search Patch_date=latest($Patch_date$) |table Patch_date,region,server,os_type,location but unfortunately both dint worked.    Please support on achieving the required.   Thanks    ... View more