The ability for many things in Splunk is controlled by capabilities applied to roles/users. In order for a user to utilize the "sendemail" command, what capabilities are necessary for their role to possess? If there is a chart which contains search commands and the required capabilities that would suffice as well. ... View more

Throughout the day, Splunk runs its internal processes and users run their queries. As the day hits its peak, searches sometime queue up (due to what I believe resources in the SHC being totally consumed). Is there a way to track how many searches queue throughout the day and for how long they remain queued until they execute (or are abandoned by the user)? ... View more

I've read on peers going into detention status due to storage capacity restrictions, however, is it possible to manually place a peer in detention status so that the data present on it remains searchable but it no longer receives replicated data from the rest of the cluster? ... View more

[volume:primary] path = opt/splunk/splunk_data maxVolumeDataSizeMB = 2000000 [3rdIndex] homePath = volume:primary/3rdIndex/db coldPath = volume:cold/3rdIndex/colddb thawedPath = $SPLUNK_DB/3rdIndex/thaweddb maxDataSize = auto_high_volume When attempting to run splunk, it results in the message: Problem parsing indexes.conf: Cannot create index 3rdIndex: path of homePath must be absolute ('opt/splunk/splunk_data/3rdIndex/db') What's strange is that I have other indexers with the same stanzas in indexes.conf, except that on those, the volume definitions were split to a separate indexes.conf. Any ideas? ... View more