if all you want is to know what happens when you run a command, you could just spin up a VM and run the command.  that's literally what DEV environments are for... [splunk@ClientMachine bin]$ ./splunk disable deploy-server Your session is invalid. Please login. Splunk username: admin Password: Login successful, running command... Deployment Server is disabled. [splunk@ClientMachine bin]$ ... View more

Well, I would not do index-time extraction. Perhaps a search-time regex extraction, but it's difficult to say without measurement whether it will be better than auto-kv. Theoretically, increasing this from 10,240 to 102,400 increases the amount of CPU usage by 10x (assuming an O(n) operation). Practically, this may only mean a handful of nanoseconds. One advantage to regex versus auto-kv is that you can limit the regex scope to particular sourcetypes. Raising the kv limit affects processing for every event. Best advice is "measure and compare". ... View more

In fairness, there are a lot of people that have done a lot more work than me on it. I will pass the love it on 🙂 ... View more

This is pretty much an entirely new question, however if you save your search and check the box to schedule it, some alerting options will present themselves. ... View more

Thanks gkanapathy. Good point about the license. I was just using two as an example, we are pushing for four. Since we value performance over availability (at least until it goes down, LOL) I'm assuming a single cluster of four search peers is better than two mirrored clusters of two search peers. Under option one (splitting the data among the search heads) is this best managed by load-balancing or deliberately dividing up where forwarders are sending their data? ... View more

This is awesome stuff! Thanks for taking the time to post this. When referencing the link you provided to ezproxy, as it compares to splunk, if the machine splunk is on (as a forwarder), for /lib/svc/method, should I simply create an empty file called splunkforwarder and link this to the binary for splunk in /opt/splunkforwarder/bin? ... View more