Hi all, I have been working with Splunk for quite a while now. Still I am wondering: Whatis the difference between chart and stats? Most of the time I find myself getting the same results no matter which function I am using... Kind regards, Katsche ... View more

Hi all, I have two searches here, which are nearly the same (5 Events more at one of them). Is it somehow possible to Subtract the 289 events of the first search from the 294 other events of the second search? Kind regards, Katsche ... View more

Hi all, I was told to evaluate Splunk to run in a really BIG company. We are talking about a big amount of log files each day. My boss asked me to clarify some of his concerns and I thought this board could be a starting point. I tested Splunk (Free) on my local computer and found out that 1GB of our log files result in 250MB of Index. Is this normal for Splunk? If this were true we would reach the capacity of every reasonable hdd setup very soon. So I am asking myself: Is there a possibility to minimize splunk's Index size? Are there special options to index a bis amount of log files very fast? Or is splunk just as fast as the hardware it is given? Is there a possibility to keep an eye on the network traffic so that there are no disruptions in real time operation? There will be lot of traffic to get all the data to the indexer. Can this be done by forwarders? I didn't have the time to read all the docs yet. I think there are more questions to asked when running splunk "BIG" but until now this are the most important questions for us. Thank you in advance. Kind reagrds, Katsche ... View more

Hey all, I am trying to handle a large amount of data with splunk. At the same time I have to keep an eye on my 500MB limit. Today i will add some compressed logs. These logs are about 30MB (compressed). Decompressed we are talking about more than 500MB per file. So I would like to now: How is compressed data counted? Thanks and kind regards, Katsche ... View more

Hi all, I think this is a question which has been asked several times. I have searched for this answers but still was not able to find a satisfying answer. I am just looking for a simple answer to this question: I have added lots of data to my Splunk Enterprise test version. This data is about 2,2GB. because of this a reached the limit today getting the message "Daily indexing volume limit exceeded today" today. What will Splunk do tomorrow? Simply go on indexing since the next day has begun or will all data which wasn't indexed today be lost? Thank you very much. Kind regards, Katsche ... View more