If you have a specific role that is identical to admin but yet you cannot do things admin can do, there are two major possibilities. We have an error where we are keying to the admin role name incorrectly in the python or compiled code The access information for the views simply refer to the admin role, eg $SPLUNK_HOME/etc/apps/search/metadata/local.meta / default.met The second scenario is more likely. ... View more

No, you can't "avoid" it - it's an integral part of how Splunk works. As for the second question, if you add an event to the file, Splunk will just carry on from its last known position (c) and read until the new end of the file (after d), so it will not have to reindex the whole file. ... View more