Hi! Use a subsearch instead of appendcols. Using a subsearch, you can search for or exclude specific events based on one or more common fields. If you want to have a list of all events in object1 which are not part of object2, try this: index=sfdc source="sfdc_object://object1_Salesforce" NOT [search index=sfdc source="sfdc_object://object2_salesforce" | rename Case AS Id | table Id] Looking at your current search I suppose you need to rename Case to Id in the subsearch so that the fields are the same. ... View more

I was able to get this working on Splunk Light with the following in /opt/splunk/etc/system/local/authorize.conf [default] [role_user] srchIndexesAllowed = * srchIndexesDefault = main;wineventlog [role_admin] srchIndexesAllowed = *;_* srchIndexesDefault = main;os;wineventlog The Splunk Enterprise parameters seem to work ok here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf I copied and edited the parameters from etc/system/default/authorize.conf ... View more