Hello, I would like to create a role which allows to add roles to users on a limited perimeter. The goal is to delegate a part of the user/role mapping to superpowerusers according to their perimeter. For example: user1 can add as role only role1 (no any other role) I have already tried with the following authorize.conf configurations [role_superpoweruser] edit_user = enabled edit_roles_grantable=enabled grantableRoles = role1; => allows to add ALL roles (including others than role1) [role_superpoweruser] edit_user = enabled grantableRoles = role1; => the user can add role1 but it removes ALL other roles Any help would be greatly appreciated ... View more

Hi, I have a difference between 2 search peers, both members of my indexer cluster, for the time to Reap Knowledge Bundle Directory. The average of the first one is about 2~3s whereas the second one is about 30s (or more). The hardware is the same, no huge difference in the network. It seems that the first one receive most of the time delta bundle but the 2nd one mainly baseline. I think that why it take more time - the bundles are bigger. It results that sometimes the searches are really slow or fail. Any idea to solve this? Regards, Francois ... View more

Hello Guys, I try to set up the Splunk Mobile Gateway, but it didn't work for me. On the configure tab, I've this error ; Then, on the status Dashboard : Error found in splnuk_app_cloudgateway.log : ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/splunk_app_cloudgateway/storage/passwords/encryption_keys?output_mode=json The proxy seems to be correctly setup and all gateway inputs are enabled. Any idea ? Regards, Fracois ... View more

Hi, I'm having trouble extracting timestamps from JSON on a production environment: Timestamp field is not used by Splunk as timestamp (and Splunk used the _indextime as timestamp). I tried to configure props.conf (see below) on both indexers and heavy forwarder (data are pulled from a data store on Azure). I have to say that on a local instance, it works fine. Here is my raw data : {"odata.etag": "W/\"datetime'2019-01-09T08%3A29%3A09.2933828Z'\"", "PartitionKey": "201901090829", "levelno": "10", "hostname": "5c6744d1d32c", "levelname": "DEBUG", "version": "v1.2.1-741-g19422ce", "component": "Watcher", "Timestamp": "2019-01-09T08:29:09.2933828Z", "RowKey": "20190109082909284-5c6744d1d32c-22-00", "message": "Watcher running...", "pathname": "/app/ccc/watcher/perimeter.py", "lineno": "61"} Different props.conf that I tried without any success : [sourcetype] CHARSET = AUTO KV_MODE = JSON MAX_TIMESTAMP_LOOKAHEAD = 20 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%dT%H:%M:%S TIME_PREFIX = Timestamp": " category = Structured disabled = false pulldown_type = true [sourcetype] CHARSET = AUTO INDEXED_EXTRACTIONS = json KV_MODE = none MAX_TIMESTAMP_LOOKAHEAD = 20 SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = Timestamp TIME_FORMAT = %Y-%m-%dT%H:%M:%S TIME_PREFIX = Timestamp": " category = Structured disabled = false pulldown_type = true Any help is very welcome 🙂 Francois ... View more