I'm guessing you work for Cribl? Anyone that has been around the block knows vendor execute benchmarks are dishonest. I know this because Cribl was considerably slower and buggy for our use case. It's written in Node for crying out loud! ... View more

You should be able to trivially clone the data into the right index/sourcetype and much much more using Cribl - check out this blog post for an example of how to clone data. ... View more

if the splunk instance is 6.7+, there isn't a need for the channel parameter in the POST ... View more

SInce there are so many presidents and watches in the index, you'd want to be in the habit of checking identity of the president first, rather than wasting all those mips counting up the other couple of hundred records. Also, since typists may get confused between the various George Bush presidents, and because the name can appear in various forms, you might be better off testing for something like... | search (first_name="George" AND last_name="Bush") OR president_number = 43 ... View more

Splunk support said that the amount of license usage will change depending on SEDMCD too. Thank you for answering. ... View more

If you only need the eventcount, then this should do the trick: index=foo sourcetype=A OR sourcetype=B Device_MAC_Address=* | eval isFromA=if(sourcetype=="A",1,0) | eval isFromB=if(sourcetype=="B",1,0) | stats sum(isFromA) as A sum(isFromB) as eventcount by Device_MAC_Address | search A>0 eventcount>0 | fields - A You may wanna watch this presentation, it gives you a good start in questions like this: http://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out& Hth, -Kai. ... View more

done it mate. thanks ... View more