Assuming you are working with monitor inputs, the files would should not be reindexed. Splunk's detection of duplicate files is based on CRC checksums. The exception would be if you have configured a crcSalt , which will let you include a fixed string or the value of source as part of the comparison. Other metadata, including sourcetype, would not be a factor in detecting duplicates. More information on the CRC calculation:      http://www.splunk.com/base/Documentation/latest/Admin/Howlogfilerotationishandled ... View more

You can run | eventcount summarize=false index=* index=_* . This search actually runs distributed, but it does add a field splunk_server so you can sort or filter on that. ... View more

Yes, this is a known problem. There is actually some old CSS in the application.css file for the search app that really should not be there. And it's that CSS that ends up damaging the layout. you dont see the bug in other apps like ui_examples because that file doesnt apply outside of the search app. It's located in /etc/apps/search/appserver/static/application.css . You can edit this file yourself to remove the offending CSS. However until we remove or fix the file in the search app, it'll keep coming back when you upgrade. It has been identified and filed and hopefully it'll be fixed soon. ... View more

See How do I find all unique IP addresses in a file? Basically you can find ip interactivly using a search command: | rex max_match=100 "\b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" Or you can setup an automatic field extraction in your props.conf and transforms.conf files. props.conf: [my_source_type] REPORT-ips = all_the_ips transforms.conf: [all_the_ips] REGEX = \b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b MV_ADD = True ... View more