Yes , I want it to expand and list all indexes. From the search I posted . It showed like this index_name Role User _audit admin xyz _blocksignature admin xyz _internal admin xyz _internal new_user_role xyz _introspection admin xyz _thefishbucket admin xyz christine admin xyz christine test_role xyz christine_new admin xyz but I do not have can_delete role your query looks like this user roles srchIndexesAllowed srchIndexesDefault xyz admin * _* main os ... View more

Thanks Martin! I try the new update search. Now it does not list the can_delete role when combined the search I posted with your search ... View more

Martin, This new one you post, does not show the can_delete role, it showed all index and other roles | rest /services/authentication/users | table title roles | rename title as user | mvexpand roles | join type=left roles [rest /services/authorization/roles | table title srchIndexesAllowed srchIndexesDefault | rename title as roles] | makemv srchIndexesAllowed tokenizer=(\S+) | makemv srchIndexesDefault tokenizer=(\S+) | mvexpand srchIndexesAllowed | mvexpand srchIndexesDefault | join type=left max=999 srchIndexesAllowed [rest /services/data/indexes | table title | eval srchIndexesAllowed = if(match(title, "^_"), "_*", "*") | rename title as IndexesAllowed] | join type=left max=999 srchIndexesDefault [rest /services/data/indexes | table title | eval srchIndexesDefault = if(match(title, "^_"), "_*", "*") | rename title as IndexesDefault] | stats values(*) as * by user | foreach srch* [eval <<FIELD>> = mvappend(<<FIELD>>, <<MATCHSTR>>) | eval <<FIELD>> = mvfilter(match(<<FIELD>>, "^[^*]+$"))] | fields - Indexes* ... View more

your search showed like this User Role Indexes admin admin * _* does not showed all indexes name ... View more

But your search only showed the admin role and indexes only show (_*) and not all the indexes ... View more

I want to match an IP in the log file to an ISP defined in the GeoIPISP lookup. so, assume If I run this search: index="nginx" | top limit=1 it returns: 1.0.0.1 Also assume, GeoIPISP.csv has two lines: start_ip,end_ip,isp,cidr 16777216,16777471,Google,1.0.0.0/24<http://1.0.0.0/24> I want to look up that IP 1.0.0.1 is in the cidr block of 1.0.0.0/24<http://1.0.0.0/24>, which then returns the ISP Google. From the info above, I think this will work in transforms.conf: [geoip_isp] filename = GeoIPISP_cidr.csv max_matches = 1 min_matches = 1 default_match = OK match_type = CIDR(ip) in props.conf [nginx] LOOKUP-geoip = geoip_isp ip OUTPUT start_ip end_ip isp Then this search index="nginx" | top isp limit=1 will return: Google is that right, or am I missing something? ... View more

To connect to Microsoft SQL Server with DB Connect using the Microsoft JDBC Driver for SQL Server and Windows authentication, follow these instructions. Be aware that these instructions assume that you're running Splunk Enterprise on Microsoft Windows. Modify the jdbcUrlFormat setting in the db_connection_types.conf file to include integratedSecurity=true. For example: jdbcUrlFormat = jdbc:sqlserver://<host>:<port>;databaseName=<database>;selectMethod=cursor;integratedSecurity=true From the Microsoft JDBC Driver 4.0 for SQL Server download, locate the sqljdbc_auth.dll file. This file is at the following path, where <region_code> is the three-letter region code (for example, enu for U.S. English), and <architecture> is the processor type (x86 or x64): Microsoft JDBC Driver 4.0 for SQL Server\sqljdbc_4.0\<region_code>\auth\<architecture>\sqljdbc_auth.dll Copy the sqljdbc_auth.dll file to C:\Windows\System32 on your Splunk Enterprise server. From the Windows Control Panel, go to Services, and then get properties on "Splunkd Service." Click the Log On tab, and then change the "Log on as" setting from the Local System account to that of the logged on domain user. Note: The domain user should have sufficient privileges to access the SQL Server instance. Save your changes, and then restart the Splunk Enterprise server for the changes to take effect. ... View more

Splunk log showed the following errors: 2014-10-21 10:24:04.543 monsch1:DEBUG:MicrosoftSqlServer - Connecting to database=MicrosoftSqlServer using JDBC url=jdbc:jtds:sqlserver://XYXS:143300/CMSICSIDAudit;ssl=request;appName=Splunk;progName=Splunk 2014-10-21 10:25:24.727 monsch1:ERROR:Scheduler - Error while reading stanza=[dbmon-tail://XXYZAudit/XYZZAudit]: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://XYZZAudit/XXYZAudit: Error getting database connection: I/O Error: Connection reset with query = select LogID, CONVERT(VARCHAR, Timestamp, 120) AS Date, Message, ActionType, Upi, RecordID, RecordTypeName, RecordName, UserID, UserFullName, CitizenRole, CaseWorkerRole, ProcessDesignerRole, AdministratorRole, EnterpriseAdministratorRole, AgentManagerRole, db_name() as DatabaseName, DiffData from Log ORDER BY LogID ... View more

Please review this link for forwarding window events log to another host http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/ ... View more

Verica JDBC driver set up doc. Make sure jar file is in classpath https://my.vertica.com/docs/5.1.6/HTML/index.htm#17520.htm ... View more

Install Vertica thin client –located the JDBC Add Vertica jdbc driver to the ../apps/dbx/bin/lib directory If you are using Vertica version version 7 , Vertica jar would be vertica-jdbc-7.0.1-0.jar Edit database_types.conf from etc/apps/dbx/local: [vertica] displayName = {enter a display name} jdbcDriverClass = com.vertica.jdbc.Driver defaultPort = {enter Vertica port} connectionUrlFormat = jdbc:vertica://{0}:{1}/{2} testQuery = select 1 from {table name} ... View more