Thanks for this! Had to make DBX 1.1.7 work with Splunk 7.0.1 and this was the last missing setting - thanks 🙂 BTW: another example that a lot of problems you encounter using Splunk, are actually not related to Splunk at all 😉 ... View more

To save your future nails from torture, check out the deployment requirements in the DBX docs, specifically the Java section: http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Deploymentrequirements#Java_Runtime_Environment_.28JRE.29 That says 1.6 or 1.7 Standard Edition, not 1.8 or server. ... View more

Upgrading to DBX 1.1.5 fixed this issue for me. ... View more

Perfect cheers ... View more

It seems if you edit the 'user' role, then inheritance also affects the 'admin' role. I removed all the permissions from the user role, which then locked my admin role. ... View more

OOPS. The backslashes need to be escaped twice, i.e. four backslashes. The search language needs escaping \\\\ -> \\ then rex needs escaping as well \\ -> \ Profit! /K ... View more

So adding "| eval STR_TIME = (now()-STR_TIME)|" has allowed the relative calculation of events, where I had previously tried this within a single eval with the cases. ... View more