Hello to all, I am using the search in the link below to find hosts that haven't logged in a certain amount of time: http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data | metadata index=yourindex type=hosts | eval age = now()-lastTime | where (age > 3600 AND age < 7200) | sort age d | convert ctime(lastTime) | fields age,host,lastTime How do I restrict certain hosts from the search? There are hosts that we don't necessarily want to be alerted on, but I wasn't able to figure out how to do it with the metadata searches. Any help would be great, and thanks! ... View more

We use the "df" script to grab disk space data from one of our Linux servers. We use the following search to pull out the "Used" number for the XFS volume: source="df" host="hostname" | multikv fields Filesystem Size Used Avail Use% Mounted | search xfs | table _time Used | eval Used=rtrim(Used, "[K,G,M,T]") The number was in the MBs, so we were able to chart it successfully, and it was in the 100s (for example, 978, 988, 994). However, now that we have reached over 1 Terabyte, the number we pull is single digits (1.0, 1.1, 1.2), and the chart is screwed up since it dive bombs from 999 to 1.0. Is there a way to convert the number (by multiplying by 1000), but only when the field contains a "T" (for terabyte), and not a "G", or "M", etc? Thanks! ... View more

We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days: frozenTimePeriodInSecs = 7776000 Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size? Thanks! ... View more