topic Re: Search Command "file" in Splunk Search

Search Command "file"

jcisha — Wed, 16 Jan 2013 05:42:46 GMT

URL : http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/SearchCheatsheet

URL in the

Display events from the file "messages.1" as if the events were indexed in Splunk.
"| File / var/log/messages.1"

Were tested with the contents of the manual
However, it does not work properly.

Search Command "file" Command does not use you asking?

Re: Search Command "file"

Suda — Wed, 16 Jan 2013 07:33:34 GMT

Hello,

You may need to add the "use_file_operator" capability into your role in order to use the "file" search command.

If my role doesn't have this capability, Splunk reports the error message; "You have insufficient privileges to perform this operation."
And the default admin role doesn't have it. So, you need to add it.

Thanks.

Re: Search Command "file"

jcisha — Mon, 28 Sep 2020 13:07:24 GMT

Thank you.
Did not set the roles(use_file_operator).