Hello, I had the same issue. You and I forgot one of the most important thing. 😀 The main problem is related to app permission, after set permission on file and the definition, go through: Apps > Manage Apps > "The App that contains the specific target lookup" Set read permission for the role that contains the user trying to read the lookup file. ... View more

I know this post is old, but this just worked for me! ... View more

(under the link) Thanks a lot. Uninstall an app or add-on To remove an installed app from a standalone Splunk platform installation: (Optional) Remove the app or add-on's indexed data. Typically, the Splunk platform does not access indexed data from a deleted app or add-on. However, you can use the Splunk CLI clean command to remove indexed data from an app before deleting the app. See Remove data from indexes with the CLI command. Delete the app and its directory. The app and its directory are typically located in $SPLUNK_HOME/etc/apps/<appname>. You can run the following command in the CLI: ./splunk remove app [appname] -auth <username>:<password> You may need to remove user-specific directories created for your app or add-on by deleting any files found here: $SPLUNK_HOME/etc/users/*/<appname> Restart the Splunk platform. ... View more

I had the same issue, in my case I solved after configure specific capabilities for this role. edit_search_scheduler I hope this will help. Rodrigo Ribeiro ... View more

Maybe my understanding is wrong, this script can be used only in the period i dont have data... That's it? I thought this script to do a difference too and add fault data, but that does not seem to be the purpose, correct? Tks, Rodrigo Ribeiro ... View more

I had the same issue, in my case I solved after configure specific capabilities for this role. edit_search_scheduler I hope this will help. Rodrigo Ribeiro ... View more

Can I use CURL to retrieve saved search? ... View more

Thankyuo @rodrigorsilva and @ddrillic ... View more

It would be simpler to adjust the input, avoid writing a regex... Example: Select `Severity Code` as Severity_Code, `Transition Code` as Transition_Code from [your_table] ... Tks Rodrigo Ribeiro ... View more

If you like, accept my answer. Thank you. Bye. Giuseppe ... View more

I have changed to this setting: TZ=UTC TRUNCATE = 0 BREAK_ONLY_BEFORE_DATE = false BREAK_ONLY_BEFORE = ^\d+:\d+\s(INFO|ERROR|FATAL|WARN|DEBUG|TRACE)\s[machine]\s\d+\sGMT TIME_PREFIX = ^\d+:\d+\s(INFO|ERROR|FATAL|WARN|DEBUG|TRACE)\s[machine]\s\d+\sGMT TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N MAX_DAYS_HENCE = 5 MAX_TIMESTAMP_LOOKAHEAD = 24 SHOULD_LINEMERGE = true Now it only break here: "dealTime": 1479323911 } , undefined , And it never break at something like 41785:11 INFO [machine] 150 GMT2016-11-16T22:31:07.330Z now . Somebody knows why this happen? Thank you. ... View more

Hi, i have some reports in NetIQ, i need to migrate to splunk. Please can one help. ... View more

Check the documentation for the "mode" setting in the inputs.conf, in the past changing to "online" mode helped a bit. Also check the no-resolve as this takes up the cycles, you don't want to resolve the objects. https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup2 It also depends on the number of checkpoint managers/connections you are handling on one forwarder. When it gets to millions of events from 50 different connections on forwarder can really get overloaded and you might need to look into distributing the load. This is just one of the scenario I have seen, but the yours might be different. ... View more

I had the same issue, in my case I solved after configure specific capabilities for this role. edit_search_scheduler I hope this will help. Rodrigo Ribeiro ... View more

Hi, It works, tks. Rodrigo Ribeiro ... View more

It worked, the file you indicated has a parameter: opsec_sslca_file = ../certs/SplunkLEA.p12 When I ran the push the files were stored in: /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/opsec-tools Basically moved the files to the location pointed to: [root@LABO2 opsec-tools]# pwd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/opsec-tools [root@LABO2 opsec-tools]# cp *.p12 ../certs/ In a way your tip led me to the exact point, thank you. Rodrigo Ribeiro ... View more

Hi, I had a specific case with the same need and got success by changing the file: $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py Find the line: 'tools.staticdir.strip_version' : False, Change to: 'tools.staticdir.strip_version' : True, Good luck ... View more