Activity Feed
- Karma Re: What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? for bmacias84. 06-05-2020 12:47 AM
- Karma Re: How to transpose or untable and keep only one column? for diogofgm. 06-05-2020 12:47 AM
- Karma Re: How to transpose or untable and keep only one column? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer?. 06-05-2020 12:47 AM
- Got Karma for How to transpose or untable and keep only one column?. 06-05-2020 12:47 AM
- Karma Re: How can I remove or hide a column in a table? for ShaneNewman. 06-05-2020 12:46 AM
- Posted How to transpose or untable and keep only one column? on Splunk Search. 08-26-2015 08:41 AM
- Tagged How to transpose or untable and keep only one column? on Splunk Search. 08-26-2015 08:41 AM
- Tagged How to transpose or untable and keep only one column? on Splunk Search. 08-26-2015 08:41 AM
- Tagged How to transpose or untable and keep only one column? on Splunk Search. 08-26-2015 08:41 AM
- Posted What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Tagged What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Tagged What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Tagged What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Tagged What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Tagged What happens in a distributed environment with auto load balancing after the minFreeSpace is reached on an indexer? on Getting Data In. 06-17-2015 07:16 AM
- Posted Re: How can I correctly search (and send report on) the last 5 minutes on an index that's generated every 5 minutes? on Splunk Search. 05-20-2015 05:46 AM
- Posted How can I correctly search (and send report on) the last 5 minutes on an index that's generated every 5 minutes? on Splunk Search. 05-20-2015 02:31 AM
- Tagged How can I correctly search (and send report on) the last 5 minutes on an index that's generated every 5 minutes? on Splunk Search. 05-20-2015 02:31 AM
- Tagged How can I correctly search (and send report on) the last 5 minutes on an index that's generated every 5 minutes? on Splunk Search. 05-20-2015 02:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 |
08-26-2015
08:41 AM
1 Karma
Hello,
I have a search returning some results that look like this:
sourcetype="somesourcetype" [ search sourcetype="somesourcetype" ... | top limit=100 email | fields + email ] | stats count by email,error
email error count
g@gogo.com 100 20
g@gogo.com 101 21
g@gogo.com 102 22
g@gogo.com 103 23
g@gogo.com 104 24
m@momo.com 100 20
m@momo.com 101 21
m@momo.com 102 22
m@momo.com 103 23
m@momo.com 104 24
f@fofo.com 100 20
f@fofo.com 101 21
f@fofo.com 102 22
f@fofo.com 103 23
f@fofo.com 104 24
How can I make my table look like this?
email 100 101 102 103 104
g@gogo.com 20 21 22 23 24
m@momo.com 20 21 22 23 24
f@fofo.com 20 21 22 23 24
Thanks!
... View more
06-17-2015
07:16 AM
1 Karma
Hello,
Having a distributed environment with N indexers and M servers sending data in a load-balanced way (autoLB=true) towards those indexers, what happens if the minimum free space is reached for one of the indexers?
The documentation says the indexer will not take any data until space is freed up and also "If one indexer is down, the forwarder immediately switches to another".
Will the load balancing algorithm on the servers just switch to the next indexer or will the data during that time frame ("The forwarder routes data to different indexers based on a specified time interval.") be lost?
... View more
05-20-2015
05:46 AM
Thanks for the answer. I'll try it.
... View more
05-20-2015
02:31 AM
Hello,
I have a summary that is being run with the following parameters:
Start time (optional): -6m@m
Finish time (optional): -1m@m
Schedule type: Basic
Run every: 5 minutes
Condition: Always
Summary indexing: checked (enabled)
The summary looks after certain data in a large, main index. The search time is about 30 seconds.
I want to send a report every 5 minutes based on a new search on the summary index above.
Which is the best way to accomplish that without messing up the intervals?
For example, I'm worried that if the indexing takes a little longer, the data will be incomplete in the report. Or, if the intervals aren't matched properly, I might run the query for the report over the previous indexing period.
Can someone explain to me if my fears are well founded and point me to some documents describing the issue in more detail?
Thanks.
... View more
