| timechart span=1m eval(sum(is_slow)/count) by v | rename NULL as ratioOfSlow did the job for me.  ... View more

I just noticed my issue is a duplicate of: https://community.splunk.com/t5/Monitoring-Splunk/In-Splunk-Enterprise-7-2-Can-you-help-me-clear-the-Splunkd/m-p/447614   ... View more

I assume you're using an all-in-one installation. In a bigger setup you'd normally not even be able to see the indexes defined on your indexers by clicking on the search-heads (the search-heads can have their own indexes if they're not configured according to good-practices to send the events to indexers). So I'd assume it's not as much a "bug" as a "misfeature". It's simply that the change to the indexes.conf is being picked up by the indexing part of the splunk daemon but since it's not being done from UI, the "search head" part of the daemon is not aware of this. It happens with other parts of the config too - if they're done in UI, the UI takes care of refreshing the config and keeping things consistent. If they're done manually by fiddling with the conf files, the UI might not catch-up immediately on the changes. ... View more

Correct, this does not improve performance. Is Splunk planning on providing a true sampling function that is applied at the index level? With the amount of data being processed today, sampling is the only manageable way to produce metrics. Thanks ... View more

Hi @jankowsr - Glad you were able to find a workaround for your question. If you would like to close out your post, don't forget to click "Accept". But if you'd like to keep it open for possibilities of other answers, you don't have to take action on it yet. Thanks! ... View more

Oh no, believe me, it's not my decision at all! I have much less impact on feature decisions than customers. And that is really how things should be. Although I have been thinking about whether I could write a custom search command to do this, and how it might work... 🙂 ... View more

Yes, I'm talking about the GUI, not the command line. You should use the search mode that gives you the best results. You can always use the fields command to eliminate fields you don't need to export. ... View more

I came across the same issue and the first thing I did was also increasing limit to literally 100MB, it's probably quite obvious as value has to be integer but what fixed the problem was setting it to max_memtable_bytes = 100000000 instead of 100MB ... View more

Am I the only one that finds it frustrating that of the ump-teen settings that can be changed via the UI, that this is not one of them? ... View more