Thanks @jkat54 I was able to do using map command ... View more

Hi @chris94089 , are you able to resolve these errors?  Can you provide some details since I am also getting same errors on deployment servers. Thanks,  ... View more

Thanks @richgalloway  After mapping SAML groups to Splunk roles do I need to delete local authentication for all users? and which will take precedence while loging in?  ... View more

@richgalloway I get message "This report cannot be accelerated." ... View more

Thanks @renjith_nair  I am using  the same query already but it runs very slow .. streamstats vs accum --> accum command runs very fast but the disadvantage is that it does not group by arguments. thanks.  ... View more

@renjith_nair  I tried with by clause for accum command but it does not support ..so is there any other way to achieve by clause Thanks ... View more

@renjith_nair  for ex. source="file1.txt" contain below data a source 1 file1.txt 2 file1.txt 3 file1.txt 4 file1.txt 0 file1.txt 5 file1.txt 8 file1.txt and another source="file2.txt" a source 2 file2.txt 3 file2.txt 0 file2.txt 2 file2.txt 0 file2.txt 2 file2.txt 4 file2.txt   From above two sample file it should extract below - a source 4  file1.txt 8  file1.txt 3 file2.txt 2 file2.txt 4 file2.txt   Could you please explain what logic can be applied to group by source ... View more

@renjith_nair Thanks for your answer. Sorry I haven't mention in question that this data is present in one file and I have hundreds of file. so I want the result by source for each file separately. hence above solution will not work. ... View more

@richgalloway Total data including hot/warm and cold data is 3TB for particular index and usually search run for last 14 days . and the searched index get data 100GB/day. (I am talking about one specific index here and my environment has multiple index and total ingestion rate is 600GB/day which will grow in future) server is not doing anything apart from splunk service. and splunk is not running high number of searches. Regarding transforms i am using heavy forwarder where all the transformation will be happening. as you said The batch_search_max_pipeline setting has no effect on standalone servers, so on which splunk environment it has effect. Also is there any reason why it has no effect on standalone server. Thanks for help. ... View more

@richgalloway  I have windows server with 35GB RAM, 16 core pprocessor and currently Memory usage is below 40% and I want to get search results faster rather than waiting few minutes to get results. And as per my understanding each search takes only one core per search even though multiple cores are not in use so I also want to utilize core for each search to get results faster. I already looked to improve/optimize searches and also I am using summary indexes for long running dashboard queries. So my question is can I increase batch_search_max_pipeline to 2 on my standalone server? will it work? Thanks ... View more

Thanks @richgalloway   some of my index data is coming from database using db connect app. so can I apply ingest-eval on that index as well? One more issue I am facing is that-  I have summary index (test_summary_index)  and I have abc fieldname in summary index as well. but problem is when I set fields.conf - [abc] indexed=true then splunk will try to search fieldname abc in metadata but it won't find any results for summary index . for ex. index="test_summary_index" abc="123" This query won't return any results. What could be solution for this issue? Can CIM be useful? ... View more

@codebuilder I am on windows os and have only batch monitoring input configured. Not sure why I am receiving older events in _introspection  index ... View more