Depends on what you need it for and when. One thing is length of the raw data itself. And that was already shown. Another thing is how much space in splunk indexes is consuned by storing this particular event. And for this there is no clear single answer as it depends on how good the event (and whole bucket data) compresses, if you extract any additional indexed files and so on. About excluding from indexes - again depends on what you really want. If you want to really prevent long events from getting indexed (why not just truncate them?), you'd have to do some check using ingest-time eval and then route to nullqueue based on the result of that check. If, however, you just want to not show long events in the results just filter your events with | where len(_raw)<120 or whatever limit you want. Don't use delete command. It has its very limited uses but generally shouldn't be used. ... View more

sorry, maybe i wasnt clear enough I want to add alert action to my alerts for the alert manager app there i have to add owner but i have no list so the only thing i can do is attach to unassigned      ... View more

Hi @SplunkySplunk, as you can find in https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Moveanindex#:~:text=You%20can%20move%20the%20index,default%20location%2C%20created%20during%20installation. the steps are the following: install on Azure the same version of your on-premise Splunk, copy all the apps in the new enviuronment, with special attention to the ones containing indexes.conf files, with a down Splunk (in both systems) copy the content of your SPLUNK_DB folder (containing indexes) in the relative folder in Azure, restart Splunk on Azure. If you have Linux both on on-premise and Azure, you could also copy the entire Splunk folder, so in this way you copy all the configurations. If you have Windows, you have to install the new machine anche copy two folders: $SPLUNK_HOME\etc the $SPLUNK_DB folder One final hint, if possible, avoid Windows OS for production systems. Ciao. Giuseppe ... View more

Thank you That what made the trick ... View more