Hi, Is there a way to determine Splunk License Usage for a specific event type.  I used index=_internal source=*license_usage.log* st=abcd to determine the license usage for the entire sourcetype. To dig in deeper for the specific event type I found articles pointing to use len(_raw) which gives the byte size length of the raw event. I used the below to check if it returns the same from license_usage.log index="x" sourcetype=abcd | bin _time span=1d | eval size=len(_raw) | stats sum(size) as sizeInBytes by _time | eval GB = sizeInBytes/1024/1024/1024 The numbers do not match. The numbers from len(_raw) are very high when compared to the actual License Usage.   ... View more

Hi all, Splunk search head web url is set to https://hostname:8000 Is there a way to change it to just https://splunk for our environment Thanks, Om ... View more

Hi, We collect windows performance logs. After the update to 7.2.0, each performance counter with a Space in its name is being filled with an underscore making us change all the alerts and searches. Can you please help how to fix this issue. Thanks, ... View more

Hi, We are trying to fin out memory leaks in windows servers, We are trying to track the Value of the counter Virtual_Bytes. How can we track the Value and check if it keeps on growing and how to determine the time for which it kept on increasing in value. > 03/07/2019_11:27:38.497_-0500 > collection=Process object=Process > counter="Virtual_Bytes" > instance=winlogon Value=2199081287680 > host = host1 index = perfmon source = Perfmon:Process sourcetype > = Perfmon:Process Thanks, Om ... View more

Hi, We are collecting windows performance logs once every two minutes to check if a server goes over 90% of the CPU usage. We are trying to track the number of minutes the values was above 90%. the events look like this 02/25/2019_14:12:37.949_-0500 collection=CPU object=Processor counter="%_Processor_Time" instance=1 Value=98.396306059935881194 We have tried index=perfmon host=* object="processor" counter="%_processor_time" instance = * | transaction host startswith=Value>90 endswith=Value<=90 |eval _duration = duration/60 | stats values(collection) values(_duration) as time_duration values(instance) by _time, host our results look like We want to know for how long is the value above 90%. We are not able to generate a dashboard which says the total duration for which the values goes over 90 and comes back below 90%. The duration in our stats table does not show the total time for which the value was above 90%. Thank ... View more

Hi, we Have been trying to detect any memory leaks on our windows servers. As of now we are just trying to compare the virtual bytes counter for two different time ranges and tracking the increase in the memory usage by a process.Later we are trying to detect patterns by saving the results in a lookupfile. Is there a better approach to achieve this. Thanks ... View more