The user that runs |metadata needs get_metadata capability, which the user role should have by default, but you may want to check that. Make sure you select the correct time in the timepicker, and change the index name as appropriate Also, the command listed above will return sourcetypes. If you want sources, you need | metadata type=sources index=indexname ... View more

Your subsearch has this at the end: | rename Account_Name as "Siglas dos usúarios com acessos indevidos" The final field has to be a field that is in your data. If you remove this line, you will have what you need, as the field passed to the base search will now be a field that actually exists in the index. ... View more

Hi The problem is that you are not allowed to POST OR DELETE from within the UI. You can only make GET requests. You will need to use something like curl to delete the search using REST: curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch Note that if the search is shared at an app level, you will have to use the user nobody, and special characters may also give you problems, as the search string needs to be URI encoded. Pro Tip: look at the id flield in the |rest splunk_server=local /servicesNS/-/-/saved/searches endpoint to see what the encoded path is. ... View more

Based on your description, it sounds like you are logging in to the GUI on the indexer, and enabling the data models there. The data models should not be accelerated on the indexers themselves. You should only enable acceleration on the search heads. Note that the data will still reside on the indexers, even though they are enabled on the search heads. It also sounds like acceleration is not enabled on your search head, which is why you do not see any data when using summariesonly=true. Once you enable acceleration on the search heads, you should be able to see data with that option. If it is already enabled, and you are not seeing data with summaries only, it is possible that the acceleration searches are not running for some reason or the other. Look through the _internal logs and the monitoring console search dashboards, if that is the case. ... View more

Not sure if you have managed to get this going, but what you need is an entry in a local alert_actions.conf Something like: cat $SPLUNK_HOME/etc/apps/my_app/local/alert_actions.conf [email] command     = $action.email.preprocess_results{default=""}$ | sendemailsplit splitfield="host" "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=10000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$" ... View more

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node. ... View more