With the 4.2 upgrade it brought along with it the real-time updating of the metadata on the main screen/dashboard for the global summary, hosts/source/sourcetypes. Is there any way to disable this and go back to how it polls once on navigating to the front page the first time and not continuously updating? Thanks, Scott ... View more

So originally I thought the way cloning would work between two indexers was that data from a forwarder setup to clone would send identical events to each indexer - this part does work fine. However, when I bring down one indexer for a few minutes on a restart or whatnot, I thought the forwarders would send to the indexer that was up, while keeping track of what needed to be sent to the second indexer when it came back online. It appears the indexer that was down never gets the data that it missed while it was down once it comes back online. Does cloning work in that as long as one of the indexers is online that is good enough for those events? Doesn't seem right as I would think cloned should be identical, but it appears that's what I'm seeing. Is the only way around this to clone to two sets of autolb'ed indexers (ie. using four total indexers)? Or what I'm seeing I shouldn't be seeing? Thanks, Scott ... View more

Trying to get a search working where instead of the whole result set passing to the next command as one, they would pass over one at a time as a sort of a loop fashion. Then also use that value as a parameter value in a next command. Here is a simple example. Let's say I have this search: "blah" | top host | fields + host | throttle name=mytest period=300 | sendemail to=somebody sendresults=true Let's say this returns two hostnames which pass through the AlertThrottle app throttle command, that then sets the suppression state and fires an email. The email contains the two hostnames from the result set. I'd like to have each hostname pass through to the throttle command individually and also use the hostname to populate the "name=" value in the throttle portion. So that after the single search it is equivalent to: hostname1 -> | throttle name=$host period 300 | sendemail to=somebody sendresults=true hostname2 -> | throttle name=$host period 300 | sendemail to=somebody sendresults=true So each result (two hostnames) generates a separate email and also using that hostname as a parameter value. Are both of those two conditions even possible? Thanks, Scott ... View more