Thanks @tscroggins i did post a new question.. How to filter a field from the log where the values change for example please see below, logfile =(result1=0 result2=5 result3=10 result4=14)  at 5AM logfile =(result1=8 result2=5 result3=10 result4=14) at 5:10Am logfile =(result1=4 result2=5 result3=10 result4=14) at 5:20Am logfile =(result1=3 result2=5 result3=10 result4=14) at 5:30Am i want query to return result and show when result1 is greater than 5, please help Current state im at =index=indexname | search sourcetype=eventname "result1=5" gives results but if i do index=indexname | search sourcetype=eventname "result1> 4" returns nothing ... View more

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Usesummaryindexing Does summary indexing count against your license? Summary indexing data volume is not counted against your license, even if you have multiple summary indexes. All summarized data has a special default source type. Events summarized in a summary events index have a source type of stash. Metric data points summarized in a summary metrics index have a source type of mcollect_stash. If you use commands like collect or mcollect to change these source types to anything other than stash (for events) or mcollect_stash (for metric data points), you will incur license usage charges for those events or metric data points. ... View more

To be more specific, you will want to route the events you don't need indexed to the nullQueue -- these events will be discarded and do not count against your license. ... View more

You're welcome. ... View more

Hi awurster, the examples provided were for Splunk 4.x and the license_audit.log is deprecated now; see the docs license_audit.log Deprecated. Look at license_usage.log instead of here. http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/WhatSplunklogsaboutitself Use the license_usage.log or if you're on Splunk 6.2.x use DMC and its pre-build alerts http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole cheers, MuS ... View more

Good question -- I was wondering the same thing. FWIW, although @johnvey's answer is helpful, I really think @sigfried's answer below deserves the checkmark, since it actually answers your question directly. ... View more

How can I email and share the diag with another team? What would be the required steps that I have to take through CLI? ... View more

In $SPLUNK_HOME/etc/system/local/web.conf set ui_inactivity_timeout to some higher value, like 1-3 hours or so. Example: [settings] enableSplunkWebSSL = 0 ui_inactivity_timeout = 180 Don't forget to restart Splunk after that. See more help here: http://docs.splunk.com/Documentation/Splunk/latest/admin/Webconf ... View more

management port is required for internal communication primarily between the splunk instances in short We can change this if we require by editing the configuration files. several other ports are 8000 web port 9997 - incoming port 8080 - replication port ... View more

this only works in 4.1 or later! ... View more

Yeah, so this thread has been around for 7.5 years and has an accepted answer. The chances of someone seeing your response is very slim. I suggest you post a new question. Reference this one, if you like. Having said that, you should be able to use a text editor to modify all instances of "WARN" to "INFO" in the $SPLUNK_HOME/etc/log.cfg file. Make a backup first, of course. Restart Splunk for the changes to take effect. ... View more