many answers here that match your question i found this to be the closest as it has similar comma separated emails https://answers.splunk.com/answers/592623/how-can-i-mask-email-ids-when-indexing.html hope it helps ... View more

Those parameters are defined in indexes.conf. If you have not set them explicitly, then the default values are assumed. You can see the state of all buckets in your index, as well as other useful information with "dbinspect". Run this from the search bar: | dbinspect index=your_index_name_here ... View more

Here you go https://regex101.com/r/yHxyYg/1 , it is working fine ... View more

| where '500' > 10 ... View more

Below query can be used to get data age of each sourcetypes. | tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where index=* by sourcetype, index, splunk_server | stats sum(count) as count, min(firstTime) as firstTime, max(lastTime) as lastTime, max(recentTime) as recentTime by sourcetype, index | fields - count | eval data_age=round((lastTime-firstTime)/86400,0) | convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) | fields index, sourcetype, firstTime, lastTime, data_age Note: Make sure to select 'All time' in time-range picker. ... View more

hey @iamlearner123 you are asking something which is already provided by splunk itself. On the license Master go to Licensing » License Usage Reporting » Previous 30 days » Split by Sourcetype The very first panel will be your answer. open in search and get the query. The query is index=_internal [ `set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by st fixedrange=false | join type=outer _time [ search index=_internal [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Modify the time period as per your requirement. let me know if this helps! ... View more

You can use this [monitor:///app/web/apacheweb/apacheweb*/apache*.log] index = yourIndexHere sourcetype=yourSourceTypeHere ... View more