The list of capabilities doesn't explicitly list this. I want a particular power user to be able to use the rest API and see a result of all users, not simply themselves. They have the ability to execute REST already, but they only ever see their own user account when running this command: | rest /services/authentication/users splunk_server=local | table realname ... View more

Is it possible, and if so, how would I, filter specific terms but only for a certain time range within a broader search? For example, say I’m retrieving all failed logons for the last 24 hours like this: index=myindex logonmessage=FAILED Now, let’s say there’s a certain account that always fails to logon between 0200 and 0300 every day called bob. We’ve investigated these and worked with the team responsible for the application, and these failures are expected and unchangeable due to some architectural considerations. How do I modify my search to basically say: NOT (username=bob AND timestamp > 0200 AND timestamp < 0300) Is that possible? Thank you all! ... View more

I'm having some issues with using regex to define the host of some events from an ASA. The events are in the format below: Jan 3 17:14:29 10.111.11.111 %ASA-6-302016: Teardown UDP connection 10101576 for external_untrusted:10.111.111.111/111 to external_untrusted:10.111.111.111/111 duration 0:00:00 bytes 0 (asdfasdf) I'm using the following regex: (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)? This works fine here: Regex pal But my event still shows: host=rel-splunk.roll.ad | sourcetype=cisco_asa | source=/var/log/syslog/asa Any thoughts on what I'm doing wrong? ... View more