Hello everyone, I am using Splunk Developer Edition . I did contents mapping for the first time in Splunk Security Essentials and implemented those contents successfully. But when I was trying to run a baseline search for those contents in the Data Availability page, there was an error forbidden. I tried to resolve the problem but everything proves abortive.
My Question
Does Splunk allow to run a baseline search when using Splunk Developer Edition, If so, While I keep getting error forbidden.
Below are screenshots I attached
Did you find a fix? I am running into the same issue and I'm logged in as admin.
This is the Baseline Search I am talking about
On clicking 'Run Baseline Search' Automatically all settings for contents already implemented supposed to run but all i see is this:
As you can see in the photo above 'Action forbidden'
How can I resolve the error