Hi, I am using splunk cloud  and  I need to disable some indexes temporarily. I am using AWS add-on app to ship AWS ALB logs from an S3 bucket. My daily ingestion data is going beyond the license and I would like to diasble these indexes temporarily.    I can see there is an option to disable an input in the inputs section, but same option is not available for index. Although in the index listing page it shows as enabled in the last column.  Would appreciate if someone has any solution for the problem mentioned above. Thanks.      Muzeeb ... View more

Hi,  Below is the information from one of my logs.  "Information","ajp-nio-127.0.0.1-8016-exec-642","11/24/20","13:30:14","CLIENT_URL","samlServices.processRequest: stuUserReturn: {""update_user_details"":1,""processByCf"":true,""USER_LOGIN"":""XXXXX@YYYY.org"",""userID"":""XXXXXXX"",""user_id"":XXXXX,""connection_name"":""XXXX"",""login"":""XXXXX@YYYY.org"",""userAttributes"":{""group_name"":""HR"",""telephone"":"""",""country"":1,""preferredLanguage"":"""",""login"":"""",""organisation"":""XXXXX English"",""last_name"":""XXXXXX"",""email"":""XXXX@YYYY.org"",""first_name"":""XXXX"",""company"":""XXXXX English""},""saml_id"":1,""loginStatus"":""success""}"   The last bit loginStatus"":""success" will be  loginStatus"":""failed" in case of failure.    I want to create create a chart/dashboard where I can get number of success requests compared to failures over a period of time. eg 30 days   Can someone please help me sort this out. Thanks.    M ... View more