I reached out to the development team and let them know your concerns, I have the same issue with an app I am developing as well. Not sure there will be any changes, but at least they know about it.  ... View more

Did you want to allow a user to see everything in CMC (e.g. data for other users?) I will let the CMC team answer the roles question, but many of the searches used in CMC currently require access. to the ~ internal ~ indexes (e.g. _audit) so users would need to have access to that data for all users, just something to keep in mind.  Would something like this work? https://ideas.splunk.com/ideas/EID-I-36 the idea proposed is having the ability for users to see their own data, but not others.  Then CMC could be written that users get access to the data that is relevant to themselves.  ... View more

Another option i was just made aware of that will work today: This will just create the file if you have > 5000 but less than <10000 events, but can be adjusted to whatever values make sense.  <populating search> | eventstats count as table_length | where table_length > 5000 and table_length < 10000 | fields - table_length | outputlookup create_empty=false lookup.csv   ... View more

Splunk now lists this as a known issue and offers a solution. Have not implemented it yet so can't vouch that it works.  We have the had the same issue for awhile.  https://docs.splunk.com/Documentation/Splunk/8.2.4/ReleaseNotes/KnownIssues     ... View more

This is a known issue for ITSI 3.0.X 2017-07-03 ITOA-8115 ITSI app throws Errors during installation ITSI components on License server http://docs.splunk.com/Documentation/ITSI/3.0.1/ReleaseNotes/Knownissues ... View more

I'm getting this error too. WHen logged in as Splunk user i get this: [code] echo $JAVA_HOME /usr/java java -version java version "1.8.0_111" Java(TM) SE Runtime Environment (build 1.8.0_111-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode) [/code] I'm at a loss as to what could be wrong. ... View more

Splunk the software may currently permit this configuration, but it should not be used. Among other possibilities, scheduled search time-to-run expressions are not timezone-independent. ... View more

$env:user$ only works some times. Sometimes it will pass the user ID of another logged on user. ... View more

Thanks for answering! Indeed, these actions could shed light on the problem then. ... View more

This is now listed as an issue with a work around for the TA. http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes ... View more

In a clustered environment it will be slightly different; index=_internal sourcetype=splunkd component=BucketMover "RemoteStorageAsyncFreezer freeze completed succesfully" (and yes, at least as of spunk 7.0.3.8 it is spelled incorrectly in the logs) 08-21-2018 14:42:09.186 +0000 INFO BucketMover - RemoteStorageAsyncFreezer freeze completed succesfully for bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955 8-21-2018 14:42:09.172 +0000 INFO BucketMover - RemoteStorageAsyncFreezer trying to freeze bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955, freezeInitiatedByAnotherPeer=true ... View more