Hi Team, I could find Splunk doc for converting multisite indexer clustering into single site indexer clustering. But I'm unable to find document for converting multisite search head clustering into single-site search head clustering. Is this possible to convert? Could you please help me here. Thanks in advance ... View more

Hi Team, We are provided with 5 servers to be configured as indexers. So we're planning to keep 3 indexers in site1 and 2 indexers in site2. So what is the best Site_replication_factor and site_search_factor value I can mention in cluster master? Please give me little bit explanation if possible. That could be good learning to me. Thanks in advance!! ... View more

Hi Everyone, On my system, I have 2 CPU cores In $SPLUNKHOME/etc/system/local/limits.conf file I got below details, max_searches_per_cpu = 1 the base number of concurrent searches base_max_searches = 6 max real-time searches = max_rt_search_multiplier x max historical searches max_rt_search_multiplier = 1 on search head, Access controls » Roles » demorole User-level concurrent search jobs limit = 10 now, the demorole role will choose which option? 8 or 10? ... View more

Hi Everyone, I'm trying to create a Scheduled PDF delivery of a dashboard and email that PDF to some internal users. I logged into Splunk as non-admin user, and then ran a query and saved as a dashboard panel. When I clicked on export option, I don't see "Schedule PDF delivery" option. But when I logged in as admin, I could see the option. May I know what role or capabilities I should add to non-admin user to enable them to schedule the PDF delivery? Can anyone please help me out here. Thanks in advance. ... View more

Hi Friends, I have the following statistics as below. Query: tag=web_app_access|timechart count by status Result: _time 200 400 403 404 503 505 2018-09-28 00:00:00 109 0 1 1 2 3 2018-09-28 00:30:00 79 6 0 0 2 4 2018-09-28 01:00:00 91 1 1 2 3 1 Now i'm trying to sum all field values except field values from '200' field using below query Query: tag=web_app_access|timechart count by status | eval total=('400'+'403'+'404'+'503'+'505') Result: _time 200 400 403 404 503 505 total 2018-09-28 00:00:00 109 0 1 1 2 3 7 2018-09-28 00:30:00 79 6 0 0 2 4 12 2018-09-28 01:00:00 91 1 1 2 3 1 8 In this case we have 5 fields to be summed up hence we used eval total=('400'+'403'+'404'+'503'+'505'). What if there are 100+ fields and we need to sum their values? Is there any way or method to sum the field values instead of manually mentioning them? ... View more