Place it in ~SearhHeadPool/etc/apps/dbx/local ... View more

Values separated by AND in a bracket belong to one search result. When multiple results are obtained, you would see and OR separating two different search result. ... View more

You are probably running a search which spits out the raw data. First Issue I would recommend appending | format to your query. For example, if your current query was index=flower_shop sourcetype=errors source=folder/myflowerlog.txt Edit it to make it index=flower_shop sourcetype=errors source=folder/myflowerlog.txt | format That should fix your first issue. Second Issue Parameters need to be sent in the query index=flower_shop sourcetype=errors source=folder/myflowerlog.txt earliest=-60m@m latest=-10m@m| format For splunk document reference click here ... View more

Finally, I could accomplish it in Java. Probably will help you to accomplish it in Python. Load the savedSearch Get the path of the savedSearch. The permission of the savedSearch is called "eai:acl". So to the path of the savedSearch, append "/acl". We'll refer to it as aclPath. Create an Args class object.Set your arguments into the Arguments class for keys - owner, sharing, perms.read, perms.write Post using the class ResponseMessage ( String aclPath, Args args) Java Sample code: SavedSearch savedSearch = service.getSavedSearches().get("my only saved search"); String aclPath = savedSearch.getPath().toString().concat("/acl"); Args args = new Args(); args2.add("owner", "their_user"); args2.add("sharing","app"); args2.add("perms.read", "where_user,queue_user"); args2.add("perms.write", "who_user, which_user"); ResponseMessage rms=service.post(savedSearch.getPath()+"/acl", args2); Works for me ! ... View more

Did you find any solution, I am trying to do the same using java. I could add to the variable, but unable to update it. ... View more

To the inputs.conf stanza add the following tail.follow.only = true ... View more