did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks! ... View more

have you tried to rename inputs.conf.windows to inputs.conf as suggested by @mayurr98 As I haven't use ITSI apps so I am not aware ...if it doesn't resolves your issue then you can post separate question Thanks. ... View more

Contact your Splunk sales rep. ITSI is a premium app (costs extra) so it's not available for download from Spunkbase. ... View more

be careful on one aspect as "license" is calculated based on _indextime, but when you search data on the host it is _time (eventtime) which might span multiple days. ... View more

Thanks Both for your prompt responses. We were seeing performance issue in the environment, Critical alerts were getting skipped due to long queues of searches. We were in the process of cleaning the unused searches and scheduled searches running every 1 min and cleaning of real time searches. We also followed the same approach of disabling the complete app if no one is using or taking consent from the user. We seems to be good now in this regard. ... View more

Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search? Thank you ... View more

Ah, now I see what you mean; I updated my answer, too. ... View more

Do want to mention a typo in the provided SPL. It should be: index=_internal sourcetype=splunkd source=*license_usage.log type=Usage h=YourHostNameHere st=YourSourceTypeHere | stats sum(b) as usage by h st | eval usageMB=round(usage/1024/1024,3) ... View more

Thanks Morris, I clubbed the output from both the search queries. ... View more

Still not possible in 7.2.4 without searching the audit index or building your own searches. In Alerts for Splunk Admins or github link I have queries like "SearchHeadLevel - Search Queries summary exact match", where I attempt to determine what was queried per-index, you could do a similar search per sourcetype but it might get tricky... Also you would never get it exactly right for wildcards, I built "SearchHeadLevel - Search Queries summary non-exact match" for that but it is complicated and slow! ... View more

Did you install the Splunk App for Server Virtualization http://splunk-base.splunk.com/apps/63700/splunk-app-for-server-virtualization This app creates the index needed for the Technology Addon for Hyper-V ... View more