ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
DevOps & observability · #splunk
Stop waiting for long-term dashboards to load. Learn how to use Splunk Summary Indexing to pre-calculate KPIs and reduce indexer load for multi-month trend analysis.
Deciding between Splunk's Universal Forwarder and HTTP Event Collector depends on whether you prioritize data reliability (UF) or deployment agility in cloud-native environments (HEC).
Learn how to set up Splunk’s HTTP Event Collector for real‑time, secure data ingestion without forwarders, plus best‑practice tips on token security, license monitoring, and performance tuning.
Learn how to diagnose and fix 'Bucket Manifest' corruption in Splunk Indexers to recover missing search results and resolve splunkd.log errors.
I am profiling a slow Splunk search using the documented Job Inspector before attempting any optimization. The inspector reports per-command execution costs such as command.search.index and command.search.typer , plus a total count of events scanned, but I am unsure which of these numbers should be treated as the definitive bottleneck signal. My uncertainty
Dynamic Field Extraction Behavior The rex command in Splunk allows for inline regular expression extractions to create transient fields during search execution. When a named capture group in a rex statement matches a field name that already exists—either as an index-time extraction or a persisted props.conf configuration—the system must resolve the conflict.
Goal: Ensure that app configurations pushed from a Splunk Deployment Server to a Docker‑based Splunk Enterprise instance are applied predictably when the same setting is defined both in a mounted app’s local/ directory and via a Docker‑passed environment variable. Constraints arise from Splunk’s configuration precedence (local > default) combined with env
docker