How can I take table output like the above and convert it into key=value pairs, so I can eval them further? I came up with a different way to do what I needed, but am still pondering the dead-end I reached before that. Say I have data like: id=0001 status=class1 id=0002 status=classb id=0003 status=classb id=f3e9 status=foo I do: | stats distinct_count(id) as C by status Now I have a table: status C class1 1 classb 2 foo 1 How can I take table output like the above and convert it into key=value pairs, so I can eval them further? Say, I want to know the ratio of class1 to classb. That is, I want to know (class1's value) / (classb's value). ... View more

I'm getting quite a few "Unable to distribute to peer..." messages when searching in splunk. The reasons given tend to be '...because peer has status = "Down".' or Authentication Failed. Sometimes just reloading the page will get through to the search peers. Sometimes it gives me that error a number of times in a row. But I've verified that the peer is not down, and I can connect to it from the search head with no problems. The splunk servers are in different datacenters, and all I can think of is that there's a little bit of network lag and the connections aren't being made quickly enough? Is there a config option to alter whatever timeout there is for this? Am I on the right track, or can someone suggest what else to look at? ... View more