Heres the ask... I want to run a spl to see what tags are MISSING from a potential host by looking at a lookup file that contains all of the required tags. So for example if everything is tagged right it should look like: ID ----- TAG 1 (env) ----- TAG 2 (location) ------- TAG 3 (owner) Alpha ---------- Dev ---------- OnPrem ---------- Bob Bravo ---------- QA ---------- OnPrem ---------- Sally Charlie ---------- Prod ---------- Cloud ---------- Fred In the real world where tags are missing it looks like this: ID ----- TAG 1 (env) ----- TAG 2 (location) ------- TAG 3 (owner) Alpha ---------- Dev ---------- OnPrem ---------- NULL Bravo ---------- NULL ---------- NULL ---------- Sally Charlie ---------- NULL ---------- Cloud ---------- Fred The lookup file I have is called tags.csv and the name of the column is "Name" which contains a list of tags that should be present on all servers: tag.env tag.location tag.owner I want to be able to run an SPL that shows me the SERVER NAME (field is called "id") and a list of the missing tags based on the lookup file (tags.csv) so it should show something like: Server Name / Missing tags: Alpha / owner Bravo / env, location Charlie / env I have been struggling with this and can get it to show me which tags match, but I can't get it to do the reverse and so far I've spent several hours looking at splunkanswers with no success. I would love some input if anyone has an idea of how to accomplish this. ... View more

When installing hadoop connect and assigning a user to "hc_admin" role I get the error "Unknown search command 'hdfs'" when trying to run the command (I know it's not a "complete" command, just trying to make sure it finds the command.) | hdfs If I add the capability of "admin_all_objects" to the hc_admin role then it starts to work and tells me missing directives which is expected since the command is not fully built. Question is how do I do grant the proper permissions for this role without granting "admin_all_objects"? Thanks! ... View more