Members

Easily find Splunk Instances (both forwarders and full installs) that have queues that are over 80% full!
index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 | […]

Have a misbehaving License Pool that the admin swears he fixed this morning?
index=_internal source=*license_usage.log* type=Usage earliest=-24h| bucket _time span=1h | stats sum(b) as bytes by _time, pool | eval […]