I have as user which is unable to build an export in Splunk Hadoop Connect; when he tries to set up an export, he gets an error: Failed to get entity object . When a user with admin role tries, it works fine, so I assume it's some specific capability missing for the user. What he tries to do is basically: * go to the Hadoop Connector app * click "Build Export" * define a search * click "Schedule HDFS Export" button * give the export a name, make sure an existing Hadoop cluster is selected, etc. * receive error message This is what I see in the HadoopConnect.log: 2016-07-13 14:10:27,664 ERROR delegating_handler.py [getEntity] [14] - Failed to get entity object Traceback (most recent call last): File "/opt/splunk/etc/apps/HadoopConnect/bin/delegating_handler.py", line 12, in getEntity return en.getEntity(entityPath, entityName, uri=uri, namespace=self.appName, owner=self.userName, sessionKey=self.getSessionKey()) File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 249, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 505, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/HadoopConnect/admin/conf-export/_new Regards Eivind Olsen ... View more

We are currently indexing logs from various Java applications. Does anyone know of some way we can calculate how much of those logs in one index are Java stacktraces, ideally as a percentage of bytes? ... View more