Hi All,  I have created a scheduled reports (its not accelerated or summary indexed) and event count is populated into another index via collect command:  index=xxxx host=yyyyy| stats count | addinfo | eval _time = info_min_time | collect index=xyz_summary sourcetype="Trip Plans Other Apps" addTime=T please note: - the indexname contains summary but this index is not a summary index.  - Report runs at morning 7 o'clock for the previous day's data and the _time is overwritten to previous date. This is done so that the count is logged in as previous day's data.   The issue which we are facing here is when we run the same query for that time period after a few days( say a month), we are observing the value inside the index=xyz_summary (i.e. count value) is greater than when we run the original query. Interestingly, the results were both the same, when I ran both queries initially a month before.   Any suggestions why is this happening (is it due to collect command) ? what modification can be done so that we dont get a mismatch here.     Thanks in advance.  Kind regards AG.      ... View more

Hi All,   I have a requirement where I need to show only alternate X axis label when I am running a chart command:  index=xyz  | bin _time span=1m| eval time1 = strftime(_time, "%d %b %H:%M")|chart count by time1.  As th query is ran for entire day and span mentioned is 1 minute,  the x-axis label is not being displayed .  Is there any way we can just show only 4 to 5 dates in the x axis label?  Thanks Arjit     ... View more

Hi Team I am running a tstats count on my accelerated data model for certain time periods. So the result which I am getting when I ran the query today is different to what I am getting tomorrow.  Though all the parameters i.e. the query & the time period for which this query is intended to run, are all the same. Can anybody please help me understand why is this happening and how can we fix this so that we can get the right result everytime when this query is run as we need to populate the dashboards based on this query?  Thanks and regards AG ... View more

Hi All, We have schedule the job which would run a tstats command on an accelerated data model for yesterday’s data & this populates the count value to an index called “xyz” via collect command. tstats count as "COUNT VALUE"  from datamodel="abc"  where .....  |collect index=xyz addTime=T When I am running tstats query and index=xyz count query for couple of days, the results are matching (which they should) but when I am running this tstats query on the same dataset for the same time period, after say a few days & comparing with the index=xyz for that date, the tstats query gives me a different result (though index=xyz result is same as what I got that day). The tstats count value seems to be increasing with time... May I know why the tstats count values are changing over the period & how to fix this issue? Thanks AG ... View more

Hi All,  For one of my apps (Google analytics App for Splunk), I am only getting 1000 events each day. Ideally this app sends all the google analytics data  into splunk, which includes server downtime and webpage upload time, so it can never by limited by quantity.  Can anybody please suggest what can be issue here ? Is there any limit to the number of events which we set up in any of the .conf files in Splunk? PS: the issue cant be at Google analytics End, This has been verified.  Thanks.  AG.      ... View more

Hi All,  In our distributed deployment we are getting the issue where 100% schedule searches are skipped failing due to "searchable rolling restart or upgrade is in progress"".  Can anybody please suggest the troubleshooting steps on how to rectify this issue?  Thanks and regards AG.  ... View more

Hi All,  As the "Google Analytics app for Splunk" has been deprecated and is no longer supported, may I please know what apps,  others are using as a replacement,  to ingest google analytics data into Splunk?   Thanks in advance  Kind Regards AG ... View more