I have the following metrics: date:01 yada yada yada total 80 date:02 yada yada yada total 120 date:03 yada yada yada total 50 date:04 yada yada yada total 110 date:05 yada yada yada total 40 I need a timechart that will take the remainder of the total (anything over 100) and add it to the total of the previous minute. e.g. should end up looking like so: date:01 yada yada yada total 100 date:02 yada yada yada total 100 date:03 yada yada yada total 60 date:04 yada yada yada total 100 date:05 yada yada yada total 40 ... View more

I am using sideview utils and I have a table that I want to tie static redirects to. For instance, if you click on the first row in the table it sends you to some HTTP URL, if you click on the 2nd row in the table it sends you to a view, etc, etc... currently im using a SimpleResultsTable that pushes to a Redirector. I was able to hack that together by creating html files that redirect you to a static link like so: http://10.1.1.1/$click.fields.series$.html. those html files would then just redirect to the static page of my choice. Any ideas on how to achieve this natively without me having to call external html files to redirect? here is the relevant piece of code I was using - <module name="URLLoader" layoutPanel="panel_row1_col1"> <module name="Search" autoRun="True"> <param name="earliest">-4h</param> <param name="search"><![CDATA[ index=_internal source="*metrics.log" group="per_sourcetype_thruput" | stats avg(eps) by series| eval actions="PLACEHOLDER" | sort - avg(eps) ]]></param> <module name="JobProgressIndicator" /> <module name="SimpleResultsTable"> <param name="count">4</param> <param name="fields">series</param> <param name="drilldown">row</param> <param name="allowTransformedFieldSelect">True</param> <module name="Redirector"> <param name="popup">True</param> <param name="url">http://10.1.1.1/$click.fields.series$.html</param> </module> </module> </module> </module> ... View more

I have an architecture that houses many individual instances of splunk. Occasionally splunk-optimizes will run at the same time for many instances. This causes load spikes. Is there any way to stagger or control when splunk optimizes are run on a per instance basis. ... View more