I am wondering if I can provide LDAP role to user group mappings in my app folder (etc/apps/MyApp/local/authentication.conf) rather than the system folder (etc/system/local/authentication.conf). These are the types of stanza's I am hoping I can put in my app rather than the system file. [roleMap_MyAD] myapp1_viewer=SplunkTesters ... View more

I'm using the splunk java logging appenders. Are there hooks for setting things like source in my app config rather than relying on splunk forwarder config on the receiving end? ... View more

I am interacting with a splunk server using apache to do single sign to the Splunk web UI. If I go to the following url in a web browser I get signed on and the page loads; which is great. https://mysplunk.test.com/en-US/app/MyApp/MyDashboard Using curl I can run something like the following and get my dashboard back; which seems great as well. curl --negotiate --user a:a https://mysplunk.test.com/en-US/app/MyApp/MyDashboard I was hoping that the following would also work...but no. Do I just have a simple error, or is this not possible? curl --negotiate -u a:a https://mysplunk.test.com/servicesNS/admin/search/search/jobs/export -d output_mode=json --data-urlencode search="| eventcount summarize=f index=MyApps_* | stats count by index" The response I get is This resource can be found at <a href='https://localhost:8443/en-US/servicesNS/admin/search/search/jobs/export'>https://localhost:8443/en-US/servicesNS/admin/search/search/jobs/export</a> ... View more

I was looking at the list of capabilities and it was not clear to me which would grant the ability to create new indexes. Could someone help me with this? Capabilities List ... View more

Imagine I have a bunch of indexes named app1, app2, app3, .... appN. Assuming I have search permissions on all of them, then I can run the following search to quickly (1 sec) get a list of existing app# indexes. | eventcount summarize=f index=app* | eval index_app=index | stats count by index_app It seems like daily someone creates a new app and doesn't bother to tell me. The way I deal with this is to reroute log events from unknown apps in a CatchAll index. Periodically I want to look at what is in the catchall index to see what new apps exist. This search works to get a list of apps that appear in the catch all index...taking only a couple seconds to run over the last few days index=CatchAll | rex field=_raw "index=\"(?<index_app>\w+)\"" | dedup index_app So one search gives me the list of existing app indexes and the other is a set of app indexes which may include new ones. My goal is to figure out app indexes I need to create, and it seems like I should be able use these two searches together to get the answer quickly. I tried to combine index=CatchAll | rex field=_raw "index=\"(?<index_app>\w+)\"" | dedup index_app |join left [| eventcount summarize=f index=app* | eval index_app=index | stats count by index_app] But this both doesn't seem to work and is super slow. It's strange because it seems like it should be 2 seconds for the first search, then 2 seconds for the second, and a fraction to diff them. ... View more