This means that the heavy forwarder can't parse the data quick enough. Easy fix: Get more resources, CPU etc or add a whole extra heavy forwarder to share the load. Harder fix: Examine all the data the heavy forwarder is processing. Set LINE_BREAKER value correctly for all large volume source types so that you can set SHOULD_LINEMERGE to false. Also be aware that nullQueue ing events is computationally expensive becuase the event still goes through the full parsing pipeline before it is discarded. Good luck! ... View more

You have 2 ways- 1. Use clean command in CLI - splunk clean eventdata -index ** , it will delete the indexed data permanently. 2. Use delete command in Splunk Web- **index= | delete , it will make your data non searchable from this particular index. ... View more

Hi ManchitMalik, you can find an example on the dev page here http://dev.splunk.com/view/SP-CAAAEVY Your js will be located in $SPLUNK_HOME/etc/apps/<yourAppNameHere>/appserver/static/ Additionally install the dashboard example app https://splunkbase.splunk.com/app/1603/ and have a look at the examples which are tagged with EXTENSION to learn more about this topic. Hope this helps ... cheers, MuS ... View more