This probably is partially covered by https://docs.splunk.com/Documentation/Splunk/6.5.2/ReleaseNotes/Workaroundforsearchoptimizationissues and https://docs.splunk.com/Documentation/Splunk/6.5.2/ReleaseNotes/6.5.2 but in my particular case (after upgrading to splunk 6.5.2), searches are fundamentally broken. E.g. given sample events like t=1487169791, rn=315827, part=LArBarrelPS, uname=nikiforo, msgID=rc::ApplicationSignaled, host=pc-tdq-onl-05.cern.ch, app=RootController, sev=WARNING, text="Application "CHIP" on host "pc-tdq-onl-06.cern.ch" died while exiting on signal 9. Logs are "/logs/tdaq-06-01-01/LArBarrelPS/CHIP_pc-tdq-onl-06.cern.ch_1487169011.out/err".", context="PACKAGE_NAME: RunControl. FILE_NAME: ../src/Controller/ApplicationController.cxx. FUNCTION_NAME: daq::rc::ApplicationController::pmgCallback(const std::weak_ptr<daq::rc::ApplicationController>&, daq::pmg::Process*, void*)::<lambda()>. LINE_NUMBER: 182. DATE_TIME: 1487169791.", params="application: CHIP. errStream: /logs/tdaq-06-01-01/LArBarrelPS/CHIP_pc-tdq-onl-06.cern.ch_1487169011.err. hostName: pc-tdq-onl-06.cern.ch. onExit: 1. outStream: /logs/tdaq-06-01-01/LArBarrelPS/CHIP_pc-tdq-onl-06.cern.ch_1487169011.out. signal: 9. ", quals="RunControl ", chained=0, gh=1414542713 simple search index=ers | search sev=WARNING returns no results, whereas the suggested workaround index=ers | search sev=WARNING | noop search_optimization=false works as before with splunk-6.4. Basically search by any non-indexed field is broken. I have some fields indexed at insertion and also field extraction configured for my events, may be there is some correlation. sample data configuration files (props,transforms,fields).conf ... View more

Hello all, I've seen a few similar discussions, but neither solution works for me - sorry for raising this again. I have a search and a chart which produces big amount of results, and to plot it I use limiter bins=2000 in my chart command. Yes, I want to display more then 1000 points on my UHD screen. But whatever chart options I use, it still complains with famous: These results may be truncated. Your search generated too much data for the current visualization configuration. and indeed the results are not complete. What I have in my chart XML code: <option name="charting.data.count">3000</option> <option name="charting.chart.resultTruncationLimit">3000</option> Is there a working option? I could not find anything relevant in limits.conf. My splunk version is 6.3.0. Thanks! ... View more

Hello, In my chart command, I'd like to select events satisfying some criteria. For example I can do: chart count(eval(field1=avalue))) by field2 but instead of count() I'd like to select an earliest event and extract a field value chart value(field3, earliest(eval(field1=avalue))) by field2 Is there a way to implement this, without complicated subsearches? For example, my data is like A=1 B=0 C=2 A=2 B=0 C=2 A=2 B=1 C=2 A=1 B=1 C=3 Then I call chart value(A,earliest(B=1)) as D by C and get C=2 D=2 C=3 D=1 ... View more

Dear all, I have in splunk events of this simple structure fileldX=value, like field1=..., field2=..., ... fieldN=... Now I need to plot a stats of my data, something like | chart avg(?), max(?) over field1, field2,.. fieldN How should I express the '?'? Do I need to create a syntetic field with values of my real filed names? Thanks! ... View more