Hi @PickleRick , I completely follow you time sync (NTP) is crucial on all layers of data sources towards Splunk if correlations shall work and make sense. I've worked a lot with time on quite a few customers sites, and way too many don't have control over their time and timezone. To the question if this would make sense or not, there is no doubt to me, that it would, and for more than one reason: Troubleshooting (mainly) time skewing latency queuing Just to name a few. As of today it not possible to measure the latency between tiers, and you'll have to use other methods to find bottlenecks etc. Yes - additional fields will be needed, and multi-value is a no-go and a mess as I see it. The challenge is, as I see it: How to add additional fields to cooked data (which they will be on the first HFwd), do you know how to do that? Is it possible to create an app on ie. the indexer (last tier), that will add the arrival at the indexer. PS. I'm know this is the _indextime if, and only if there is no HFwd between the UF and the Indexer, else _indextime will be set at first HFwd, which is useless for this purpose. @isoutamo - Your idea about adding an idea at splunk is fine, but my experience with it is no so positive, it's too slow in my opinion. The smartest and fastest ideas comes here 👍   ... View more

I know why I added the idea😉 ... View more

I know it is, why I also raised the idea you pointed at😉 And I'm pretty sure there are workaround to it as well, but the ones who knows how are really hard to find, but I hope they will popup here ... View more

This was how to change the timestamp, what about number formats? How and where do you change the thousand separator from comma to dot, and vise versa the decimal separator from dot to comma. See - that would change my (and a whole lot others) world to a new dimension! ... View more

Hi MuS, Thanks for your speedy response, and currently our [ldap] is the like: ldap allow_multiple_matching_users 1 ldap max_mem_usage_mb 3000 ldap max_users_to_precache 30000 What I think is the interesting thing here is that when using ldapsearch we can get up till 10,000 rows. I can't find any other key/values for the [ldap] stanza, do you know of any? Cheers, Bjarne ... View more

Hi MuS, Thanks for your speedy response, and currently our [ldap] is the like: ldap allow_multiple_matching_users 1 ldap max_mem_usage_mb 3000 ldap max_users_to_precache 30000 What I think is the interesting thing here is that when using ldapsearch we can get up till 10,000 rows. I can't find any other key/values for the [ldap] stanza, do you know of any? Cheers, Bjarne ... View more

But there is a limit to 1000 groups! How can that limit be changed or bypassed? ... View more

When sizelimit is set to 10000, and we still only can get 1000 rows out of: | rest services/admin/LDAP-groups using SPL, and ldapsearch can easily provide the 10000. What is then wrong? We running v7.1.3 ... View more

Same problem here ... View more

Same problem here, and turned it into Splunk Sweden, but have no reply yet! ... View more

I'm facing same problem, and have raised it with Splunk in Sweden, but have not got any response yet. ... View more

Can I as, why there is no solution to this problem? PS. Same problem here - unfortunate! ... View more

Hi Skalli, I valid your points, but there are more constraints here - unfortunate. We're over capacity on our Index cluster, and we can't get more core to the existing servers, that's just the way it is. So I'm frankly looking for alternatives to how we can add more capacity while keeping the current servers. Bjarne ... View more

Hi Skalli, Thanks for your response. Approx 4TB/day We have seen IOPS issues even though we're running all on SSD SAN disks. And we have experts looking into it. We're aware of this as well, but this is not I'm after at all in this question:-) Yes sure, the CM is the "brain", but exactly how smart is it? My question here is all about exactly that! SF:2 RF:3 Multisite is in the tube soon, but we have another capacity need before we get there. The DMC is great, but again can't answer what I'm looking for:-) Let me be more precise here: What will happen to our Index Cluster if we add 12 more servers each with 6 cores (In total 72 more cores) to our already existing 16 indexers with each 12 cores (192 cores in total)? Will we gain 50% more indexing and/or search capacity? How will the CM handle the divergence in cores/host? Do we HAVE TO have total equal hosts in the Index cluster (I know it's recommended, but recommended it not always possible to get)? This IS a Splunk infrastructure challenge, and I'd like/need to know how flexible /smart the system is. Best Regards, Bjarne Dein ... View more

Hi Guys, Above is a most interesting question, and I'd like to extend it even further... Say you have an Index Cluster with 10+ servers already running each with 12 core CPU's, and we need more cores in the cluster to deal with the raising demand for ingesting even more events coming in. Seen in the light of running it all virtual hosts (Linux) on VMWare, what will happen to the Index Cluster if we add another 5 Index Servers to the cluster - each with less core's (6 each)? In other words: Even though it might not be the most optimal solution, will the Index Cluster still benefit from adding more servers with less cores each (compare to existing), or will that make it even worse. PS. The reason for asking is that right now it's much faster to get new servers with 6 cores. I'd be most happy to get some input on this subject, and in general hear a bit more about how "intelligent" the different Splunk instances are in dealing with divergence in capacity in clusters (Indexer and Search Heads). Best Regards, Bjarne Dein ... View more