Updated link: http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/Overview ... View more

An additional benefit of discrete indexes is that they preserve the option of provisioning discrete higher performance storage as necessary. This can optimize storage provisioning costs when search activity patterns cause relatively higher disk i/o latency for indexes with relatively smaller data storage size requirements. ... View more

| localop | stats count -> remoteSearch = None ... View more

Did you try explicitly setting recursive = true ? Reference: Inputs.conf ... View more

Did you try explicitly setting recursive = true ? Reference: Inputs.conf ... View more

Splunk does not actually support full outer joins with join . join type=outer is equivalent to join type=left . I've been approximating full outer joins with append followed by stats first(...) : sourcetype=st_1 search_field_1=key_1 search_field_2=key_2 | append [ sourcetype=st_2 search_field_1=key_1 search_field_2=key_2 ] | stats first(output_field_1) as output_field_1 first(output_field_2) as output_field_2 by search_field_1 search_field_2 That works fine as long as you are looking for at most one result from either side of the "join" and the two searches will not return conflicting values. Its possible this works for me in this form specifically because in my case each output field will either be null or populated at most once per key set. ... View more

(sourcetype=st_1 OR sourcetype=st_2) id=id_to_search_for ... View more

How Splunk DB Connect works - v 2.0.2: Download the Splunk DB Connect add-on, and then follow the instructions in either the single-server or distributed deployment installation topics. You can use Splunk DB Connect on a heavy forwarder to support continual data gathering or output. For more interactive use, including lookups, you should install the add-on on a search head. ... View more

Could you add a bit more context? I'm specifically wondering about your use of the word target and whether that is implying a lot of context that I am missing. I've strictly worked with Splunk in the last couple of years and am at a disadvantage in recognizing some of the terminology assumed by users of the other platforms. Splunk can create a single search job that returns many events across multiple indexes. When it is reasonable to create custom fields at index time, these are very efficient to search at very high scale but come with lots of advisory notices since poor decisions on deploying these can be very troublesome to recover from. The most efficient such statistical search would be based on tstats, which works great for statistics assuming you do not require the search output to contain the full event text but just a summary of counts of events matching various conditions and the like. tstats can not be run using a Splunk real-time search so you would likely use a scheduled job with a historic search across a recent time frame that is within your tolerance level for processing latency. Configure index time field extractions: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction tstats: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats ... View more

Options: Add a timestamp column to the CSV and have it populated on every row Use a command / script input to capture and index the current contents of the file ... View more

I'm interested but have not yet started pursuing this. As one approach, some integration can be achieved via the shared capabilities of both Splunk and R with relational databases / CSV files. Can you add some context regarding your use case in terms of direction of data flow and realtime requirements? e.g. are you looking to process Splunk output in R or consume R output in Splunk. Splunk consuming R output: - Splunk could use a data input command to periodically run an R script and index the results. - An externally scheduled (cron) R script could stage output in a CSV for Splunk to incorporate using a lookup. This would be good for a particularly expensive R script if the results do not need to be realtime. - A Splunk lookup can also run an R script inline with a search. ... View more