Greetings... I'm still very junior to the world of Splunk so I thought I'd reach out to the community for a little direction. We are running the Enterprise Security Suite 3x version on Splunk 6.1.3. I have noticed the following messsage is generated daily: "msg="A lookup table used in a CIDR or WILDCARD definition exceeds the maximum allowable value" file="asn_by_cidr.csv" size="14690788" limit="10000000" I have tried (with little success) to find out where this size limit is defined. Has anyone else seen this error and if so, could you suggest where to change this setting? Thanks in advance ... View more

Greetings, There is a compliance officer at my company that is making a lot of noise regarding the reports that the Active Directory application generates in 5.0.6. We want to give her access to run some reports herself but do not want to give her too much access (if you get my meaning). What I would like to do is to restrict her access to one or two reports and not allow her to access anything else. I’d also like to restrict her search abilities to 30 days maximum (otherwise she will cripple the search heads running All Time reports). So my question is…. Is this possible? Is this an Active Directory group policy or can it be configured from the admin console? I have searched all over the admin console and roles but really didn't come up with anything of value. Am I missing something? Any help or suggestions are appreciated. ... View more