We have successfully configured the EMC Isilon Add-on for Splunk Enterprise in our distributed environment and is currently pulling data from one cluster/site. If we want to add a second cluster/site into the Add-on, do we just enter the information of the second cluster/site in the 'Add any of the Cluster node credentials' page or will that overwrite our current setup? ... View more

Just finished setting up a kvstore collection within the collections.conf and pushed it out through the deployer to our search head cluster. Per the Distributed Management Console, everything is looking good on all search head members in the cluster and I can find the collection within the settings of an actual SH member. Upon creating a new lookup definition that will reference this kvstore, I still only see 'file-base' and 'external' as options. Odd. Decided to create another kvstore, but this time via the API. The kvstore was created successfully and per the DMC, things again were looking good and I was able to find the collection on all the SH members in the cluster. Still no 'kvstore' option when creating a lookup unfortunately. Next tried creating the lookup manually within the transforms.conf and pushing it through the deployer. Lookup shows up on all the SH members in the cluster, although, when I open it up to review its configuration, it looks broken. The name and fields_list are there, but no mention of the kvstore collection I specified. Rather, it shows me a random CSV file and an empty 'command' field. At least it shows 'kvstore' in the type list for that specific lookup, but doesn't mean much if it's broken. Decided to restart the specific SH I happened to be on to see if anything would change. Nothing. Curious if anyone knows the reason for why the 'kvstore' type would be missing in a 6.2.x search head clustered environment? My testing in a stand-alone environment was successful. ... View more

Hello, Been suck trying to figure out what type of object needs to be passed along with my key/value pair, in PowerShell, to update the 'srchIndexesAllowed' setting for a user role. Below is the code I've been using but the updates haven't applied correctly. What I'm attempting to do is remove a specific index from the values, then apply the remaining values back to 'srchIndexesAllowed'. $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add("Authorization","Splunk $sessionKey") $UserRole_Get_Response = Invoke-RestMethod -Method Get -Uri "$base_url/services/authorization/roles/test_user_role" -Headers $headers $UserRole_Get_Response_List = $UserRole_Get_Response.content.dict | ForEach-Object {$_.key} | Where-Object {$_.name -contains "srchIndexesAllowed"} $arrUserRole_srchIndexesAllowed = @($UserRole_Get_Response_List.list.item) # Remove index from role $arrUserRole_srchIndexesAllowed = $arrUserRole_srchIndexesAllowed | Where-Object {$_ -ne "index2remove"} $body_post = @{ srchIndexesAllowed="$arrUserRole_srchIndexesAllowed" } # Apply update $UserRole_Post_Response = Invoke-RestMethod -Method Post -Uri "$base_url/services/authorization/roles/test_user_role" -Headers $headers -Body $body_post Unfortunately it ends up applying the remaining values as a single long string which doesn't work. This can be seen via https://splunk_server:8089/services/authorization/roles/test_user_role Before: 1. main 2. test 3. index2remove After: 1. main test Checking to see if anyone else in the community has successfully passed multiple values for a key to Splunk's API via PowerShell. Thanks! ... View more