This can be accomplished by creating another role that inherits the User role and adds the edit_indexer_cluster ​ capability. With such a role, the user can see the indexer clustering settings menu and place the cluster into maintenance from the CLI as well. ... View more

If you use the Field Extraction tool built into Splunk, you will not need to build the regex yourself. When viewing such an event in Splunk, open the event by clicking the ">" carat to the left of the event, then click the Event Actions button, then click Extract Fields. This will take you to the Extract Fields wizard where you just highlight the text you want to extract and give the field a name... ... View more

You need to contact Splunk Support and request a "reset key" to reset your existing license violations to zero. The problem is that the previous license violations do not automatically clear out when you apply a new license. Without the reset key, the excessive violations will remain until they age out after 30 days. ... View more

The answer here is NOT to change the field extractions of the original, raw data. It sounds like you want to treat the value of u_cr differently for some values of event than those from other values of event. In that case, you could just change the value of u_cr for those events dynamically at search time to get what you need. For example, if you were summing u_cr but wanted to exclude the value of u_cr from that summation for events where the event field equals "vil", you could just set u_cr to zero for those events right in the search; for example: ... | eval u_cr=if(event="vil", 0, u_cr) | stats sum(u_cr) I hope that helps. ... View more

See this link: https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/W746177d414b9_4c5f_9095_5b8657ff8e9d/page/MaaS360%20&%20Splunk%20Integration ... View more