Holy Cow, great stuff -- thanks! why, oh why, could Splunk not have had something like this...? ... View more

You can add the "indexes_edit" capability to the role. This will allow a user to create and edit indexes.  ... View more

_TCP_ROUTING in the default stanza should work, but it didn't work for me either. ... View more

NEW FEATURE UPDATE! See documentation here: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports 5. (Optional) Determine whether the search should run as Owner or run as User. This setting determines whether the search runs with the permissions of the search Owner (the person who defined the search) or the permissions of the search User (the person who is running the search). Reports run as Owner by default. For a detailed explanation of why this setting is significant and how it works, see "Running reports as the report owner or report user," in this topic. http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports#Determine_whether_to_run_reports_as_the_report_owner_or_report_user ... View more

Pretty good answer...capturing the error message rather than first message seen more aligned with my use case. ... View more

My understanding is that it is tied to the session timeout under settings->general as would normal web session logins to the search page. ... View more

Makes sense. Thanks ... View more

./splunk reload auth ... per Securing Splunk Enterprise > Edit authentication.conf. (Other answers include the command but not the corresponding Splunk LB article.) ... View more

Just a note if somebody runs into the same problem we did: ... -d value="groupA;groupB;groupC" everything after the first semicolon is cut and ignored, even though properly quoted in the command line. We could get around that by using the hex code representation for the semicolon: ... -d value="groupA%3bgroupB&3bgroupC" ... View more

I don't think authentication.conf can be placed at app level. The documentation suggests to put the custom mappings to etc/system/local only. Definitely an easy/convenient way (see http://answers.splunk.com/answers/103900/is-there-a-walk-through-on-how-to-deploy-authenticationconf) ... View more

I see...thanks again. ... View more

To be clear...my fail above was trying to access REST API endpoints not available through the web UI. Not supporting SSO for the REST API seems like a miss to me. Would love to hear peoples thoughts if there are good security reasons for not having it. http://docs.splunk.com/Documentation/Splunk/6.0.1/Security/HowSplunkSSOworks "Splunk's SSO implementation supports logging into Splunk via Splunk Web only. Since Splunk SSO relies on cookies to save authentication information, SSO cannot be used for CLI authentication to Splunk. Invoking https://localhost:8089 (or the assigned management port) still requires independent authentication." ... View more

Try this | set diff [| eventcount summarize=f index=app* | eval index_app=index | stats count by index_app | fields - count] [search index=CatchAll | rex field=_raw "index=\"(?<index_app>\w+)\"" | dedup index_app] ... View more

The field is optional, by default is applied to _raw. You need to specify it if you already have the text in a field to narrow the extraction. ... View more

yes, each event has to be compared to the regex and routed, it adds load to the indexing. ... View more

Hello, You are correct in your approach, but if you want the granular info you need to see the perfmon counter more frequently i.e. the interval needs to be in seconds. And you should not be concerned if there is a CPU spike for a second or two. Monitoring perfmon _total instance per day wont consume much from your license volume. Second approach is an indirectly get the average value of your perfmon counter using one script. For that you need to collect instantaneous data into csv file using windows data collector and rather than perfmon.conf , in INPUTS.CONF you trigger a script which calculates the value for you and send an average for that 5 mins or whatever interval you want so that you don't loose anything. Thanks ... View more

I think this is literally the answer to my primary question. ... View more

What I have show above mimics index and forward, it is just less cumbersome and makes it easier to change. Changes using this method also do not require a restart of the instance either, just a reload of the EAI Objects. ... View more

Yes. $1 will contain the value inside the parenthesis. ... View more

@gkanapathy gave what seems to me the simplest, performant answer, so thanks! Love all the other answers too with diff takes on it. ... View more

You need lastChanceIndex but this is a global setting; this is as close as you can get: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf#GLOBAL_SETTINGS ... View more