Hi,  We have 2 Splunk authentication systems - SAML,Splunk (default). We wanted to have an alert, if the user login to Splunk via "Splunk" authentication system. Is there way to do that? Can we do this via Splunk query? need help on this. Thanks, Mala S ... View more

We have an custom app which contains just props and transforms configs... When we try to upload app.tgz file. it throws below failures Need some insights on this. Source code and binaries standards [ failure ] Check that files outside of the bin/ and appserver/controllers directory do not have execute permissions and are not .exe files. On Unix platform, Splunk recommends 644 for all app files outside of the bin/ directory, 644 for scripts within the bin/ directory that are invoked using an interpreter (e.g. python my_script.py or sh my_script.sh), and 755 for scripts within the bin/ directory that are invoked directly (e.g. ./my_script.sh or ./my_script). On Windows platform, Splunk recommends removing user's FILE_GENERIC_EXECUTE for all app files outside of the bin/ directory except users in ['Administrators', 'SYSTEM', 'Authenticated Users', 'Administrator']. This file has execute permissions for owners, groups, or others. File: default/transforms.conf This file has execute permissions for owners, groups, or others. File: metadata/default.meta This file has execute permissions for owners, groups, or others. File: default/props.conf This file has execute permissions for owners, groups, or others. File: default/app.conf ... View more