Just define shorter retention time for indexes. But usually this is not an option. Basically you must add more space to your system. In best practices you should start to use volumes which automatically freeze old data and make new space available on your index storages. https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstoragesize r. Ismo ... View more

@ac89live No.. I have opened a case with Splunk support. ... View more

I'm facing the same issue Have you managed to resolve the issue ? ... View more

I was trying to install this app 'report sender' and when I launch it got the following message: Looks like this view is using Advanced XML, which has been removed from Splunk Enterprise. Please contact your Splunk administrator Is there any other app who does the similar thing ? Because I also want to export custom visualization in PDF format. Thanks ... View more

This is new deployment. Here is what I also did: --- Moved from SAS to SSD --- Upgraded CPU to 16 --- Restart to the server Now CPU usage is 80% when generating PDF , but still not PDF is generated ... Regarding the article, where can do the "splunk reload deploy-server -timeout  200" ? This is IIS Server 2016 ... View more