You should use this app https://apps.splunk.com/app/1876/ instead of the one named "Splunk App for AWS". ... View more

You would either need to define a field to differentiate the types. Or you can use the "Patterns" tab to have Splunk generate event types to help differentiate different patterns of event text. ... View more

You may be thinking of the exporttool and importtool commands. These are only necessary if you're moving some of the data from main. If you're moving all data in main, you can simply copy the buckets/folders from main to the new index (while Splunk is stopped, and not taking into account if you're using clustering). ... View more

This works, but I might suggest the use of the eventstats command rather than appendcols with a subsearch. That is probably a little more efficient, i.e., replace the | appendcols ... | ... with | bucket _time span=1d | eventstats count as TotalNumOrders by _time | ... ... View more

It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.) ... View more

And the reason the service still exists and that you don't want to delete it is that it is still possible to reconfigure the system to use the old SplunkWeb/CherryPy UI server. If you need to do so, then you will need the Service to run and control the process. ... View more

I'm guessing you have a realtime search that includes a subsearch as part of the RT search. ... View more

because both the old and new versions existed on the search head already and therefore can compute the delta there instead of copying a large file for a small change. ... View more

Yes, it is replicated each time there is a change and a new search has to run. The delta bundle is pushed simply so that the entire bundle doesn't have to be copied over the network, only the changed portions. ... View more

Although, I do believe that if one site doesn't have enough servers, it will try to replicate to the other. Maybe you want this, maybe you don't. ... View more

This is a better answer than mine. ... View more

You can search both with one search head, but you need two masters, one for each cluster. ... View more

Ah I see you've modified your question. Then perhaps: index=windows [ search index=windows | top limit=3 showperc=f user | where count > 3 ] | eventstats count by user | dedup 3 user sortby - count ... View more

index=windows | top limit=3 user | where count > 3 ... View more

I don't understand what you're asking for. Why are you using multi-site clustering in the first place? Why don't you just create two separate clusters? ... View more

What do you mean by "When you configure the input from wire data you list a destination"? Do you mean you created a new wire data instance, and pointed the Splunk App for Stream Location at your heavy forwarder? Or do you mean you modified the default mod input instance and added a _TCP_ROUTING entry that pointed at the heavy forwarder? ... View more

Actually you don't need to pair transactions or sessions if you just want the total number in a given time period: ... | rex "Session (?<s_sid>\d+) \(\@\) started" | rex "Session (?<e_sid>\d+) ended" | timechart span=1h count(s_sid) AS logins count(e_sid) AS logouts | eval net_logins=logins-logouts | streamstats global=t current=t sum(net_logins) as cumulative_net_users | timechart span=1h sum(cumulative_net_users) ... View more