Does anyone know how to hide a radio input in a Dashboard? We have a regex calculation that we've assigned to a radio input and we used that input as token to rename values for us within the dashboard. Is there a way to hide that input while still using the calculation as a token? Thanks ... View more

We currently have a Search Head (SH) cluster with members at 2 different sites. 1 site is failing to send emails and create Jira tickets successfully. We are looking into the network changes that need to be made to fix this but in the mean time, is there a setting we can change so all alerts come from the SH members at the working site or even just delegate 1 member to send out all alerts? Thanks ... View more

Hi, We are are setting up our indexes to all have a retention policy of 180 total days. 10 days in hot/warm and 170 in cold. Below is a sample stanza that we plan to setup for each index. Can we get some suggestions if this will fit our needs or if there's a better approach? [ai_gomez_1] repFactor=auto homePath=/opt/splunkdb/ai_gomez_1/db coldPath=/mnt2/splunkdb-cold/ai_gomez_1/colddb thawedPath=/mnt2/splunkdb-cold/ai_gomez_1/thaweddb # Roll hot buckets to warm (after 7-days) maxHotSpanSecs=604800 # Roll warm buckets to cold when warm bucket count reaches this value (default=300) maxWarmDBCount=10 # (Delete data) roll warm/cold buckets to frozen bucket (after 6-months) frozenTimePeriodInSecs=15552000 # Max size of index in MB, max value: 4294967295 maxTotalDataSizeMB=4294967295 Thanks ... View more

We just migrated over to a multisite indexer cluster and we're seeing "Search Factor" (SF) and "Replication Factor" (RF) are not met. Below is the server.conf setting we have on the master node: [clustering] cluster_label = ***** mode = master #pass4SymmKey = ***** pass4SymmKey = ***** replication_factor = 4 available_sites = site1,site2 multisite = true site_replication_factor = origin:2,total:4 site_search_factor = origin:2,total:4 The setup is 2 indexers per site and there are 2 sites. As you can see HA is a big deal here so they wanted to max out the RF and SF. We're also seeing a bunch of fixups with the message below: Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ site1:2 } I've seen some posts that say changing the replication factor to 2 fixed this issue in the past. If we do that, would leaving the site RF at "site_replication_factor = origin:2,total:4" still give us 4 copies across the 4 indexers? Thanks ... View more