Splunk 6.1's license usage reporting will let me view my license usage by index for the last 30 days, but the graph only shows 10 indexes. The rest are presumably in the entry titled "OTHER". How do I get a report that lists all of my indexes? I opened the search for the graph and viewed it in the Statistics tab, but I still have a column called "OTHER". Here's the search that I'm using. I don't see where it's combining indexes into "OTHER". index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by idx fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | fields - "stack size" ... View more

Anyone here got some recommendations for forwarding Windows event logs to Splunk without installing the Splunk forwarder software? Is there a good tool to send Windows event logs as syslog events? Our other servers and devices send their syslog data to dedicated Splunk forwarder servers. That works great so my company wants to do the same with our Windows servers. Before anyone asks: The universal forwarder started eating up 6GB+ RAM out of 8GB on our domain controllers. It's not the first time, so it's gone and it's not coming back. So please no responses telling me to install the splunk forwarder software on the Windows servers. Thanks. ... View more