Hello, I have the following search: sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc... I would like to add a sparkline to count the individual occurrences of the project_field, however, the below results in a sparkline with a flat line with zeros for values: sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc... | stats sparkline count by project_field When I try to add a sparkline to the beginning of the search, I'm seeing an error because the project_field is one of the grouped by fields. Any ideas? thanks! ... View more

I have an unstructured log file that looks like the following. How would I go about creating key/value pairs for metrics like "Queue Additions Max Time" or "Data Insertions Avg Time" when part of the qualifier for the field name spans a different line than the metric name and value? thanks 17-09-2013 17:36:58,489 CDT INFO [scheduler-2] [org.hyperic.hq.common.DiagnosticsLogger@105] [com.hyperic.hq.measurement.server.session.BatchAggregateDiagnostic@75a20d1c] Batch Aggregate DataInserter Diagnostics Configuration: Workers: 10 QueueSize: 500000 BatchSize: 1000 Queue Additions: # calls: 1585 Max time: 12 ms Avg time: 0 ms Data Insertions: # calls: 966 Max time: 640 ms Avg time: 27 ms Queue size: # entries: 0 Max size: 1403 ... View more

Hello, I have a search head that has the webintelligence app loaded. I've created the summary indexes on a pair of remote indexers. Populating the indexes is done via scheduled searches - my question is where should these searches actually run? I'm not sure what is the best setup for this: If I enable forwarding on the search head it seems that the summary searches run on the search head and then forward the results to the remote indexes (I have forwarding enabled on the search head.) The data needed to generate the summarization is also located on the same remote indexers as where the summary indexes are located. Does this mean that the search is distributed (from the search head), results are sent back to the search head and then forwarded back to the remote summary indexes? The app is not actually installed on the remote indexers. If I install the app on both and enable just half of the scheduled searches on each (and disable all from the search head) - will this accomplish the same thing with the benefit that the searches would be running locally where the source data and the summary indexes are actually located? Is this any more efficient than the first method? Thanks! ... View more

According to this link, it's possible to send the datastore buckets to different disk volumes to take advantage of different RAID configs. http://wiki.splunk.com/Deploy:BucketRotationAndRetention Which bucket is associated with realtime searches? Is it always "Hot" or is the data cached somewhere else? We have an app that is dependent on several realtime searches and we're trying to optimize performance. thanks ... View more