Thanks to somesoni, I ran: index=_internal sourcetype=splunkd component=TailingProcessor '/data/scada/testlogs/capacity/CapacityIndex01-09-2014.txt' which returned: 01-16-2015 11:19:10.811 +0000 WARN TailingProcessor - Insufficient permissions to read file='/data/scada/testlogs/capacity/CapacityIndex01-09-2014.txt' (hint: Permission denied). I guess it has to do with Splunk process account not having sufficient priviledges to read in the folder where the file was written. I created another input in another folder, and copied the same file there, and it worked, the data got indexed. ... View more

index=_internal sourcetype=scheduler ... View more

As for smart clustering, you can always write a Python custom search command that does exactly what you need. Look at etc/apps/search/bin/pyrangemap.py for an outdated but easy to understand example. As for your regex-based bucketing, you can do that natively roughly like this (pseudosplunk): your search | eval mybucket = case(match(myfield, "myexpression1"), "mybucket1", match(myfield, "myexpression2"), "mybucket2", etc.) | (event)stats count by mybucket If you use stats you'll get just the count by mybucket as the result, if you use eventstats you'll get the count field added to each search result according to its value of mybucket. ... View more