Here is what I could have a summary: 1. Splunk authentication (I call local settings) and all local users' login/password are stored at  $SPLUNK_HOME$/etc/passwd file. After users login, their profiles will be located $SPLUNK_HOME$/etc/users/ directory. 2. This is a way that I use to manage the users because I am using radius authentication as mentioned above. I listed the links to download and configure below that I followed so you could do your lab. After completing the app installation and configuration, logging to SH > Click Settings > Add Data > Files & Directories ($SPLUNK_HOME$/etc/apps/radius_auth/local/user_info directory that will be monitored > follow the rest of the basic process. Download app: https://splunkbase.splunk.com/app/981/ Configuration the radius access: https://lukemurphey.net/projects/splunk-radius-auth/wiki/Install_and_Configuration   (I could not show you my system snapshot because it is not the lab but if you have one, you could share it.) ... View more

Yes, @richgalloway is right! As our Search Heads are configured with RSA authentication, I created and monitored a local index in Search Head to track the JSON file for each user in SPL. $SPLUNK_HOME$/etc/app/<app_name(default: radius_auth>>local/user_info/<hash>.json ... View more

Hi: I believe, it is not the same. The post has an issue with the 'syslog-ng.service' app that would not be started.  ... View more

  For me, it should work, but could you try this.    filter f_all { not filter(f_cisco_asa); }; http://www.softpanorama.org/Logs/Syslog_ng/configuration_examples.shtml   ... View more

Hi: You can use this cmd follow to see what lines could cost the issue. I used to use to find mine as well. Please let me know your outcome. [ root@hostname ]# journalctl -a | grep syslog-ng   Also, I am concerning this code follow that you might check as well. I will double-check with it as well since I have never used it before. filter f_all { not ( filter(f_cisco_asa) ); };   ... View more

Please disregard my question. It is working now after clearing the browser cache. Have a great day!   ... View more