I'll readily admit that I haven't done such in Splunk, but I've used LDAP queries to find disabled accounts. In Splunk you would modify the user base filter, to include a match that the appropriate bit(s) in the userAccountControl attribute are set or not set. This site seems to have an excellent guide to all of the bits that are encoded in the userAccountControl attribute. They also have a guide to the bitwise ldap filters Edit: Maybe a filter like: (& (objectClass=user) (userAccountControl:1.2.840.113556.1.4.803:=512) (! (userAccountControl:1.2.840.113556.1.4.803:=2) ) ) A user, who is a normal user and not a computer or something, where the account disable bit is not set. One line for easy copying: (&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) ... View more

LINE_BREAKER and BREAK_ONLY_BEFORE are both props.conf settings, and they're used in different parts of the parsing / indexing process. You can see a detailed chart of this on the Splunk Wiki. But LINE_BREAKER defines what ends a "line" in an input file. By default it's any number of CR and LF characters. (Depending on your format of your input, this could need to be altered for correctness, or if your log format can be separated into events by a simple regex, LINE_BREAKER can be altered to find the event boundary, and SHOULD_LINEMERGE can be set to false to skip the next step of the process). During the next phase, Splunk takes the individual lines and combines them back together to form events. (Certain log formats may have multi-line events, especially stacktraces). BREAK_ONLY_BEFORE is one of many attributes used to determine where the event boundaries are. ... View more

If I'm correct as to what you're asking, it may be as simple as instead of using stats using chart | chart sum(ORDERTOTAL) over age_group by index ... View more

I'm not sure if this is it, as I haven't looked deeply enough to do the math but I think your format should be TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z since the - is part of the timezone specification (UTC-04:00 versus UTC+04:00) ... View more

After ingesting your logs, Splunk stores thes logs in indexes. The default index is main, but often times people create their own since it's at this level where you can define access controls and (applicable here) a retention policy. You might be interested in this doc: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setaretirementandarchivingpolicy For each index, you can tell Splunk to freeze (by default this means delete, however it could be configured to mean to archive to long term storage) data that is too old or when the index contains too much data. By default these are very large (7 years 500GB if I remember correctly) but they are likely the parameters you're looking to set in indexes.conf ... View more

So borrowing a trick from Kyle Smith's conf2014 talk... We could do something like the following: serial_num="NTEST9B" | eval p_{phase} = _time | stats first(p_*) as * by serial_num,host,segment_id This gives us results that has the callresult time and the precall time for every host and segment id for a given serial num. The calculating the difference is as simple as ... the above search | eval difference=callresult-precall difference being of course value in seconds since _time is epoch time. ... View more

You could use appendpipe to use stats to add the statistics rows like this: <existing query> | appendpipe [stats sum(percent) as percent by index] | sort index ... View more

It looks like you're interested in the changes over time so off the top of my head maybe something like: index=os sourcetype=df host=* mount=* | streamstats last(storage_used) as last_storage current=f by host,mount | eval host_mount=host.":".mount | eval delta=storage_used-last_storage | timechart sum(delta) by host_mount ... View more