Our normal index volume is less than 100 MB a day, putting us squarely in the free edition usage range. However, over the weekend, an SQL server hit a size limit and proceeded to dump 20 GB of logs (8 GB/day) to the windows event log. Yea, gigabytes. So subsequently my Splunk went over-limit for those 3 days and I can no longer search. Is there any option to set a limit from the Splunk data input side to prevent this sort of massive overage? Any advice would be greatly appreciated. Thank You, ~ Michelle ... View more

Every time I try to run a report on a search, I get 0 records and the following error in the chart editor: Field '_time' should have numerical values. My Query is: CallDetail>-1 sourcetype="3CX_cdr_custom" Dest<100 | rex field=Duration "(? <DUR> . * ).. * " | convert dur2sec(DUR) as DurationSecs | stats sum(DurationSecs) as CallTime by Dest | search CallTime > 0 Basically, I configure the DUR = 00:00:XX, removing any numbers after the decimal place. The stats in the results view look perfect, but then I try to run a report with sum(DurationSecs) split by Dest, It gives me the error. I can't pick CallTime from the report field list, so I used sum(DurationSecs) instead. Any help would be greatly appreciated. ~ Michelle ... View more