I'm going through these older journald posts for other reasons, but it looks like no one has updated responses here that there's better ways now? Splunk 8.1 (which was released around the time you asked this question) introduced native journald input support (separate from any TA for *NIX):  https://docs.splunk.com/Documentation/Splunk/latest/Data/CollecteventsfromJournalD ... View more

Agreed... I'm going through these older journald posts for other reasons, but it looks like no one has updated responses here that there's better ways now? Starting in Splunk 8.1 there is native journald input support (separate from any TA for *NIX):  https://docs.splunk.com/Documentation/Splunk/latest/Data/CollecteventsfromJournalD ... View more

I know this is an older post, but I didn't see anyone yet mentioning that this looks to have been solved by journald support in recent versions of Splunk (starting in Splunk 8.1), correct? https://docs.splunk.com/Documentation/Splunk/latest/Data/CollecteventsfromJournalD ... View more

Interesting, I'm not having any error. Maybe open this up as a new question as it may be unrelated? ... View more

In Splunk 8.0 the ability to clone a role was added. Simply go to the Roles page, and next to a role select Edit > Clone! ... View more

Zooming OUT should re-execute the search since you are now including new content (when zooming OUT you are including more time than the original search). Whether or not re-execution happens during zoom IN is a different matter (and doesn't appear to be your question). UPDATE: If we look at the Jobs page (Activity > Jobs), we can see that zooming in and out all create new jobs that run. Doesn't that answer our question? In my case I can see jobs running for both zoom in and out. ... View more