Thank you so much for the quick response. Is there any way to allow an end user to create or run a saved search that would trigger my scripts to enable/disable this indexed file? What I would like to do is have a way for our developers to turn on or off indexing for some debug files that are needed at times, but other times would just create a lot of unneeded noise in the indexes. I have been able to create shell scripts to enable and disable the monitoring of the files in question, but have come up blank on a way to allow the user to actually make this change. These users do not have access to the splunk server, just to the web interface. Any additional help would be very appreciated.
... View more