You can get cleaner results by adding a table. |rest /services/search/jobs | search eventSorting=realtime | table label, author, dispatchState, eai:acl.owner, label, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, splunk_server, title ... View more

I ran into the same problem.  Here is how I solved it. This document states "If your role doesn't have write access to Global team, the New Entity button isn't available."  https://docs.splunk.com/Documentation/ITSI/4.14.1/Entity/ImportCSV I also had internal error logs "Unknown role 'winfra-admin'." I created the role winfra-admin and ran 'splunk cmd python itsi_reset_default_team.py' and the button appeared. ... View more