I have a custom command that returns results in tabular format with a _time column as well. Its something like below | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name=* | map search="| dyntmetricdata dynt_server=psg-dynatrace-qa.abc.com application=$name$ metric_path=\"Application Infrastructure Performance|*|Agent|Agent Channels|App Config Poll\" earliest=-1d@d latest=@d " time application dynt_server count current frequency sum 4/28/2020 0:00 PBM-Analytics-UAT psg-dynatrace-qa.abc.com 20 11 TEN_MIN 7 . . 4/28/2020 23:00 PBM-Analytics-UAT psg-dynatrace-qa.abc.com 20 11 TEN_MIN 78 4/28/2020 0:10 APM-Analytics psg-dynatrace-qa.abc.com 23 14 TEN_MIN 77 . . . 4/28/2020 23:10 APM-Analytics psg-dynatrace-qa.abc.com 26 19 TEN_MIN 73 I need to calculate the total of sum column and compare it with the total of today's I get the total for yesterdays using this command | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name=* | map search="|dyntmetricdata dynt_server=psg-dynatrace-qa.abc.com application=$name$ metric_path=\"Application Infrastructure Performance|*|Agent|Agent Channels|App Config Poll\" earliest=-1d@d latest=@d " | addcoltotals sum | tail 1 But I dont know how to compare with todays. Can someone please help I did try this https://www.splunk.com/en_us/blog/tips-and-tricks/compare-two-time-ranges-in-one-report.html but it doesnt work for me since my data is from a custom command I guess ... View more

I read KV store and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KV store lookups and other lookups? ... View more

If I dont provide local folder for a splunk SHC app, will all the UI changes get saved under default splunk app folder? ... View more

We have an environment where we directly write data to Splunk indexers via TCP inputs. The reason for this kind of set up is kafka consumers consume data from Kafka and later this is writtent into splunk. Sometimes this tcp takes too much time and data doesnt get into Indexers. Is there a way to monitor if this data really gets into splunk? Also how can we find out how much data is writtent into any indexer at any given time? ( we do not have a clustered Indexer and would like to know the how much gets into every Indexer - we have like 100 Indexers) ... View more

I read splunk docs and understood the below: Splunk Index archiving from cold to frozen to a particular location can be done either via Automatically by splunk Indexer Or by using coldToFrozenscript.py This will archive data to a particular directory that we mention in indexes.conf. However it faces problems in cases of clustered architecture due to same multiple buckets being copied as per below doc. https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Automatearchiving Im planning to use Hadoop Data Roll to send the splunk index data to Hadoop for longer Retention wherein it CAN be further processed/analysed using hadoop technologies(hive,pig, etc) A) Now my Qs is - I configure the splunk index archiving to Hadoop by following the below steps i.e creating a Hadoop provider and updating indexes.conf with the below details and as per below doc? [splunk_index_archive] vix.output.buckets.from.indexes vix.output.buckets.older.than vix.output.buckets.path vix.provider https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/ConfigureSplunkindexarchivingtoHadoop B) Does Hadoop Data Roll require the coldToFrozenExample.py script to send data to Hadoop? C) Does Hadoop Data Roll tackle the multiple copies issue? D) Can someone kindly help what does this doc refer? https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/SetanarchivescripttoHadoop Whats the difference between the steps in my above Qs in A) and using this script for data transfer to Hadoop? OR Is it mandatory to use this script for Index transfer to Hadoop? I'm really confused, Kindly Help..... ... View more

Our Splunk and Hadoop Clusters are in 2 different Domains ABC/splunk and XYZ/hadoop. Splunk Doc states the below: A subdirectory under jobtracker.staging.root.dir (usually /user/) with the name of the user account under which Splunk Analytics for Hadoop is running on the search head. For example, if Splunk Analytics for Hadoop is started by user "BigDataUser" and jobtracker.staging.root.dir=/user/ you need a directory /user/HadoopAnalytics that is accessible by user "BigDataUser". Does this mean I need to have the same service account ABC/splunk created under /user/ in Hadoop? OR does this mean the directory name should be the same as the name that splunk is running as? is it should be /user/splunk i.e only name should be same? ... View more