Hi, it seems the "splunkd service" process has significant CPU consumption (eg 40%; 31% and so on). These virtual machines have 2 cores. how many CPUs are recommended in a windows server running the splunk universal forwarders agent? ... View more

Hello Hello I have the following Splunk search syntax which returns me detailed log connection for a all user to the VPN concentrator (F5) in the past 90 days. I would need to do the same search only for 30 login_name users from csv, how can i build the search syntax? my actual search for all user with " | search login_name=*  "  is :       index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time           ... View more