I posted an answer in another page that may help. I rewrote all the DB queries so it's all native to the SCCM app. Re: Splunk community NEEDS an answer for getting S... - Splunk Community ... View more

Is there no royal way to do this? I mean, can't you get access to the dashboards via the REST API just as with PowerBI where you can download a report? Or via a Javascript wrapper where you provide the credentials by your own app?   ... View more

There may be a better answer, but our solution to problems like this is to write a script (PowerShell for Windows) that iterates over all of the files called local.meta in all of the $Splunk_Home\etc\apps\[app]\metadata folders. You'll want to add power to the read and write attributes. E.g. Change: access = read : [ admin ], write : [ admin ] to: access = read : [ admin, power ], write : [ admin, power ] You'll need to restart your instance after making these changes. ... View more

Hi @TobiasBoone, You're looking for admin_all_objects it's the only way to give access to all searches, reports, alerts regardless of who own them. Morei info here : https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Rolesandcapabilities Be careful though as this could be too much permissions for your power users. Another way to do this would be to ensure that all newly created objects give power user the capability to write. This can be done by setting role level permission for the applications you wish your power user to edit. Let me know if that helps. Cheers, David ... View more

Yep its a system wide setting even if its in an app 🙂 ... View more

[afterglow] disabled = 0 neato_path = C:\Program Files (x86)\Graphviz2.38\bin perl_path = C:\Perl64\bin from reading the default confs this is what I am thinking it should be... but not entirely sure. ... View more

there is actually a savedsearch command that you can use in a subsearch. https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch ... View more

Something like this should work ...| foreach p* [ lookup wkst_risk_control asset_risk_position AS "<<FIELD>>"] ... View more

I also got this error when I created the directory for forms as described in the documentation - "$SPLUNK_HOME/etc/apps/.../forms". Instead try "$SPLUNK_HOME/etc/apps/.../form", without que final 's'. https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Kvform ... View more

You need eventstats . Try using | eventstats count AS CountByMachineName by machinename first. See what this does and go from there. ... View more

The query isn't the issue, splunk didn't get the time correct at index. ... View more

Actually this is only possible for Event Log events - because Splunk has to parse them, even on a Universal Forwarder. Since Splunk has to translate the event log binary to text before it is forwarded, it seems logical to add the capability to filter the events locally. However, no other data inputs are parsed during the inputs phase. Therefore, the events cannot be filtered using a Universal Forwarder. If you must filter the events locally, you can use a Heavy Forwarder, which processes both the input phase and the parsing phase before forwarding. Be aware that this will increase the processing load on the local machine, which is usually a bad idea for a forwarder that lives on a production server. ... View more

cd splunk/etc/auth for i in *.pem; do echo $i && openssl x509 -in $i -text |grep -A 2 Validity; done server.pem Validity Not Before: Mar 25 17:03:32 2013 GMT Not After : Mar 24 17:03:32 2016 GMT regenerate server.pem $SPLUNK_HOME/bin/splunk createssl server-cert -d /opt/splunk/etc/auth -n server .... subject=/CN=server/O=SplunkUser Getting CA Private Key unable to write 'random state' subject= /CN=server/O=SplunkUser issuer= /C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com notBefore=Apr 6 15:43:00 2017 GMT notAfter=Apr 5 15:43:00 2020 GMT new file ls -ltr -rw------- 1 2747 Apr 6 10:43 server.pem -rw------- 1 17 Apr 6 10:43 ca.srl verify for i in *.pem; do echo $i && openssl x509 -in $i -text |grep -A 2 Validity; done server.pem Validity Not Before: Apr 6 15:43:00 2017 GMT Not After : Apr 5 15:43:00 2020 GMT restart, issue fixed ... View more

In your lookup table, you might be able to use eval Exists=if(match(Field,), TRUE, FALSE) Which might pass the value through to the match statement, see if it can find it, then add a where clause just before your table. ... View more

Does that mean your question is solved? ... View more

We would love to see windows support for this app. At least if we could get the streamer to collect data on it we could manually ferret through the data. ... View more

Another possibility might be to implement this as a view workflow: A first panel would be driven by a search listing all anomalous events and present them as a table, one anomaly per row. An in-view drilldown is available when the user clicks on one of the anomalous results, populating a secondary panel showing the events surrounding the anomaly. We use such a workflow in the "Crashes" view of the S.o.S app, if you'd like to see an example. ... View more

I believe needs to be all caps. ... View more

its in server.conf but under the httpServer stanza http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf sever.conf [httpServer] disableDefaultPort = true Confirm with a netstat that your splunkd port is no longer listening ie. netstat -an | grep tcp | grep LISTEN I ran into this during vulnerability scans also. ... View more

This color is set in the app's application.css in the appserver/static directory. The class you're looking for is appHeaderWrapper . Example: .appHeaderWrapper { background-color: #003D57; background-image: none; border-bottom-style: solid; border-bottom-width: 0px; } ... View more