About will_paxata

will_paxata · ‎10-06-2015

I'll assume that is the default for Splunk Cloud as well. Thank you, ChrisG!

masonmorales · ‎08-07-2015

Your user account needs to be assigned the can_delete role.

ChrisG · ‎05-13-2015

Thanks, glad that was helpful!

will_paxata · ‎05-12-2015

Thanks krish3. That view in your screenshot is reachable from the splunk search UI but not from the listview of all reports. DIFFERENT UI!

will_paxata · ‎05-12-2015

The solution is to 1) create an intermediate file of ACTIVE users, then 2) do a lookup between the list of ALL users and ACTIVE USERS to get the INACTIVE users. 0) Have a list of all users uploaded to Splunk called "all-users" 1) Run this search to create the intermediate file named weekly_active_users.csv: * | stats dc(userid) as "loggedin" by userid | outputlookup weekly_active_users.csv 2) Run this search to see the INACTIVE users: | inputlookup "all-users" | lookup weekly_active_users.csv userid as userid | where isnull(loggedin)

jayannah · ‎01-12-2015

The following configuration for any splunk enterprise version (not for universal forwarder) The below configuration send the data with sourcetype=mysourcetype to the 192.169.1.1 indexer and remaining data to 192.168.1.1 indexer. Hope this configuration helps you. props.conf ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [mysourcetype] TRANSFORMS-tcpfwd = sendtotcpreceiver transforms.conf ~~~~~~~~~~~~~~~~~~~~~~~ [sendtotcpreceiver] REGEX = . DEST_KEY=_TCP_ROUTING FORMAT=tcpreceivergroup output.conf ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [tcpout] defaultGroup = default-group [tcpout: default-group] server = 192.168.1.1:9997 [tcpout:tcpreceivergroup] <-- To Splunk indexer server=192.169.1.1:7999

chanfoli · ‎01-10-2015

Please note my edit at the end of my answer, it may help you.

Posts	13
Solutions	1
Karma Given	5
Karma Received	3
Member Since	‎11-17-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How long does Splunk Cloud store logs?

In Splunk Cloud, how do I delete data?

Change timezone on Splunk Cloud

How to schedule report with email with pdf attachm...

Search for inactive users in my application

Can I configure defaultGroup when remotely deployi...

splunkforwarder not forwarding to sandbox with Tcp...

Re: How long does Splunk Cloud store logs?

Re: In Splunk Cloud, how do I delete data?

Re: Change timezone on Splunk Cloud

Re: How to schedule report with email with pdf att...

Re: Search for inactive users in my application

Re: Can I configure defaultGroup when remotely dep...

Re: splunkforwarder not forwarding to sandbox with...

Join the Conversation