How can the error code be matched up to the PDF? It is as simple as a one-to-one match? If so, you could probably just use a lookup (CSV) file which matches up the error code to the URL and produces a new field with the URL (like error_code_url). If you really want to make the link easy to use, you could make a custom event renderer that converts the field into a URL. ... View more

There is a couple ways to do this but the best is probably to use a suppression rule. The nice thing about suppressions is that you apply to all matching events and you can easily modify the suppression to reverse the effects if if doesn't work the way that you hoped. Below are directions: Open the ES Configuation page and open "Notable Event Suppressions" Click "new" to make a new one Create the suppression with a search that matches the events you want to suppress. If you want to suppress all of them, them make the search something simply "index=notable". Make sure to set an expiration date, otherwise, your notable events will all be hidden. Save the suppression once you are done. By default, the suppression does not apply retro-actively. However, you can change this by editing the suppression. Click the suppression to edit it and set the time appropriately. Since you have a new installation, you may just want to set the time such that it matches all events before the current time. This can be done by editing the part of the search with "_time>=" to something like "index=notable _time<1359784000 _time>=0" Here are some notes on the contents of the search: index=notable: this needs to be present in all of the suppressions so that the associated eventtype matches notable events _time >= 0: this defines start of the time range that the suppression applies to _time < 1359784000: this defines end of the time range that the suppression applies to ... View more

Root Cause: The issue is due to the fact that the lookup files are not writable. The PCI needs to be able to update the lookup files in order to function. Solution: To fix the issue, set the permissions on the lookup files to allow them to be writable by the account that Splunk is running under. The lookup files that need to be adjusted are available under the lookup directory of the following apps: SplunkPCIComplianceSuite ($SPLUNK_HOME/etc/apps/SplunkPCIComplianceSuite/lookups) PCI-Requirement11 ($SPLUNK_HOME/etc/apps/PCI-Requirement11/lookups) ... View more

You actually need nothing other than either a local or default folder and the config file you want. if you're not a third party providing the app/config to someone else for potential override, you should use local and not default . Config in there (if it's search time) will be scoped only to the app however, and you'd need a metadata/local.meta or metadata/default.meta file to export it. Inherently global configs will be global of course. You don't need an app.conf or anything else. ... View more