Hello, My events contain strings such as: notification that user "mydomain\bob" has notification that user "fred" has  notification that user "01\ralph2" has  I'm trying to write a conditional EXTRACT in props.conf, so that the a new field 'domain' is assgined the domain name (i.e. mydomain, 01) where specified, else is assigned NULL and new field 'user' is assigned the user name (i.e. bob, fred, ralph2). This works well enough when there is a domain and a user, but oviously not when there isn't a domain: EXTRACT-domain_user = notification\sthat\suser\s\"(?<domain>[\w\d]+)\\(?<user>[\w\d]+)\"\shas I'd be grateful for some assistance.       ... View more

Hello. I am running 8.2.2 on Linux.  I have a SHC with three members. I have three indexes.  I would like to restrict the searchable index for each role and I would like to understand the best way to distribute that change. I used the web GUI to create the roles, which the cluster replicated.  However, the GUI does not permit non-internal indexes to be deselected.  Therefore, I have edited authorize.conf on each member.  I am using srchIndexesDisallowed.  An account with role_user_a should only be able to search index_a.   The configuration below works, but how should I manage changes like this given the GUI limitation -- should I continue to edit the file directly (along with authentication.conf) going forward (and not use the GUI)? $ splunk btool --debug authorize list role_user_a /opt/splunk/etc/system/local/authorize.conf [role_user_a] /opt/splunk/etc/system/local/authorize.conf cumulativeRTSrchJobsQuota = 0 /opt/splunk/etc/system/local/authorize.conf cumulativeSrchJobsQuota = 0 /opt/splunk/etc/system/local/authorize.conf importRoles = user /opt/splunk/etc/system/default/authorize.conf rtSrchJobsQuota = 6 /opt/splunk/etc/system/default/authorize.conf run_collect = enabled /opt/splunk/etc/system/default/authorize.conf run_mcollect = enabled /opt/splunk/etc/system/default/authorize.conf schedule_rtsearch = enabled /opt/splunk/etc/system/default/authorize.conf srchDiskQuota = 100 /opt/splunk/etc/system/default/authorize.conf srchFilterSelecting = true /opt/splunk/etc/system/local/authorize.conf srchIndexesAllowed = index_a /opt/splunk/etc/system/local/authorize.conf srchIndexesDefault = index_a /opt/splunk/etc/system/local/authorize.conf srchIndexesDisallowed = index_b;index_c /opt/splunk/etc/system/default/authorize.conf srchJobsQuota = 3 Thanks for your help. ... View more

Hello.  I am running 8.2.2 on Linux.  We have four clustered indexers and are using SmartStore.  I would like to empty an index (and recover the disk space).  I have thus chosen to remove the old_data index from the cluster, then add it back again.  I have performed these steps: 1. Stop any data being sent to the index. 2. Edit indexes.conf and delete the index's stanza (via the CM) then apply the changes to the peer nodes (each restarts). 3. Remove the index's directories from each peer node. 4. Check on the SHC for events in the index (index=old_data); no events are returned (all time). 5. Once the cluster shows that all indexes are 'green', re-add the index as normnal (editing indexes.conf again and applying the update). However, now searching the index on the SHC returns some/most of the events.  My guess is that the cache manager / the S3 storage also needs to be purged.   If so, how is this best achieved? I have avoided using index=old_data | delete because I understand this will only mask the data from searches (and I want the disk space back too). Many thanks for your time. ... View more