This is an index time setting and therefore not required at universal forwarder.   Here is what you can try: SHOULD_LINEMERGE= true Along with one of: BREAK_ONLY_BEFORE, BREAK_ONLY_AFTER ... View more

From the first look of it: splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py']   The usage of execution is throwing exception because script is not being passed one of 3 arguments: setup, execute or persistent.   Try passing one as the argument and see if the error goes away.  ... View more

Can you please post your splund.log ... View more

In case you are looking to give write permissions to an app, here is what you are required to do: Source: splunk docs Steps 1 From the Splunk Home page, select any app in the Apps Panel to open the app. 2 Click on the Applications menu in the Splunk bar, and select Manage Apps. 3 Find the app that you want to adjust permissions for and open its Permissions settings. 4 On the Permissions page for the app, give the role Read and Write permissions. 5 Click Save to save your changes. ... View more