You should use this app https://apps.splunk.com/app/1876/ instead of the one named "Splunk App for AWS". ... View more

You would either need to define a field to differentiate the types. Or you can use the "Patterns" tab to have Splunk generate event types to help differentiate different patterns of event text. ... View more

You may be thinking of the exporttool and importtool commands. These are only necessary if you're moving some of the data from main. If you're moving all data in main, you can simply copy the buckets/folders from main to the new index (while Splunk is stopped, and not taking into account if you're using clustering). ... View more

This works, but I might suggest the use of the eventstats command rather than appendcols with a subsearch. That is probably a little more efficient, i.e., replace the | appendcols ... | ... with | bucket _time span=1d | eventstats count as TotalNumOrders by _time | ... ... View more

It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.) ... View more

And the reason the service still exists and that you don't want to delete it is that it is still possible to reconfigure the system to use the old SplunkWeb/CherryPy UI server. If you need to do so, then you will need the Service to run and control the process. ... View more

I'm guessing you have a realtime search that includes a subsearch as part of the RT search. ... View more

because both the old and new versions existed on the search head already and therefore can compute the delta there instead of copying a large file for a small change. ... View more

Yes, it is replicated each time there is a change and a new search has to run. The delta bundle is pushed simply so that the entire bundle doesn't have to be copied over the network, only the changed portions. ... View more

Although, I do believe that if one site doesn't have enough servers, it will try to replicate to the other. Maybe you want this, maybe you don't. ... View more

This is a better answer than mine. ... View more

You can search both with one search head, but you need two masters, one for each cluster. ... View more

Ah I see you've modified your question. Then perhaps: index=windows [ search index=windows | top limit=3 showperc=f user | where count > 3 ] | eventstats count by user | dedup 3 user sortby - count ... View more

index=windows | top limit=3 user | where count > 3 ... View more

I don't understand what you're asking for. Why are you using multi-site clustering in the first place? Why don't you just create two separate clusters? ... View more

What do you mean by "When you configure the input from wire data you list a destination"? Do you mean you created a new wire data instance, and pointed the Splunk App for Stream Location at your heavy forwarder? Or do you mean you modified the default mod input instance and added a _TCP_ROUTING entry that pointed at the heavy forwarder? ... View more

Actually you don't need to pair transactions or sessions if you just want the total number in a given time period: ... | rex "Session (?<s_sid>\d+) \(\@\) started" | rex "Session (?<e_sid>\d+) ended" | timechart span=1h count(s_sid) AS logins count(e_sid) AS logouts | eval net_logins=logins-logouts | streamstats global=t current=t sum(net_logins) as cumulative_net_users | timechart span=1h sum(cumulative_net_users) ... View more

A Universal or Light Forwarder can also forward to multiple indexers, so if that is the only thing you are considering, there is no point in using a Heavy Forwarder. Nevertheless, there is no difference in deploying Stream on Heavy Forwarder vs a Universal Forwarder. ... View more

I would say that you're doing something wrong if you're indexing data in Splunk and then deleting it 15 minutes later. Splunk indexes are not intended to hold mutable data, and it's pretty bad at it. (The delete command for example is really only for exceptional cases and doesn't actually remove data from disk.) If you need something that is always, you could consider using lookup files, or (when version 6.2 comes out). These are intended to supplement Splunk use cases with a mutable store. However, if this is your primary data, then Splunk may not be the right solution for this. ... View more

You should probably just set the $PATH before you start Splunk up to make sure your python is there before the system one. Suggestions to install the LWF or heavy forwarder because they come with python are probably a bad idea, since you're looking to use a specific version with your own packages, not the version that happens to come with Splunk and includes the Splunk packages (and which you may not want to update). Part of the reason the UF exists is so you can use whatever version you like. ... View more

You say each name has its own comparison value, but where does that come from? It's hard to know how to construct a search without knowing where the input comes from? ... View more

if you really like the name avg(count) I believe you can do it by quoting the name: ... | stats avg(count) | eval 'avg(count)'=round('avg(count)',2) ... View more