You can give users read permission to an index by editing their role (Settings -> Authentication -> Roles). There's two settings, indexes searched by default (what happens when you don't specify index=foo ) and indexes searchable. Out of the box all users can search all non-internal indexes, so they should already be able to search with index=os - if not, add that index to their indexes searchable setting. ... View more

The Log File Analysis for Oracle 11g add-on paper describes step-by-step exactly how to do what you're talking about. Using the "dbquery" command from the DB Connect app, you can generate all the reports you're talking about, without affecting your Splunk license. A report query would look something like this: | dbquery "oradb" "select to_char(report_date,'DD-MON-YYYY HH24:MI:SS'), report_type from report_log" | timechart count by report_type ... View more

Hi, I found the macros.conf file for this and commented out the original macro and replaced with what you gave. I get this error when I try and run the report now, I am pretty new to this so honestly dont know which part would be causing... Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*."\""'. If its an easy one I would appreciate it 🙂 Thank you for the help! ... View more