I agree, but in some cases it makes sense to give a single user the ability to upload logs to a dedicated index (eg. siem detection usecases). I had to give Admin rights to the server, and that was not the way I wanted to set the permissions. Kind Regards Patrick ... View more

You can add the "indexes_edit" capability to the role. This will allow a user to create and edit indexes.  ... View more

Perfect. Thank you! ... View more

Wow! As simple as that! Thank you! Just to simplify. All I had to do was change my drilldown from this: To this: Now when I select a date column, my time picker changes! Thanks @acharlieh !! ... View more

12 Years later, still the only solution I have managed to find! Thank you 🙂 ... View more

Splunk now has an "IN" operator. So you can simply add the following to your search: CAR_MAKE IN (BMW, Volkswagon, Ford) If your search values have spaces, it will need to be wrapped in quotations. E.g: CAR_MAKE IN (BMW, Volkswagon, "Mercedes Benz", Ford) I know its late, but hopefully it can help people looking for it now. Also, you may want to correct the spelling of Volkswagen 🙂     ... View more