apologies @woodcock i am too late here but would it work with a role not having rtsearch capability  ? doc says  schedule_rtsearch Lets the user schedule real-time saved searches. The schedule_search and rtsearch capabilities must also be assigned to the role. ... View more

@_JP on current setting part i am kind of good with below query  | rest splunk_server=local /services/authentication/users | fields title, roles | mvexpand roles | append [ | rest splunk_server=local /services/authorization/roles | fields title srchDiskQuota rtSrchJobsQuota srchJobsQuota cumulativeSrchJobsQuota cumulativeRTSrchJobsQuota | rename title as roles] | stats values(srchDiskQuota) as srchDiskQuota, values(rtSrchJobsQuota) as rtSrchJobsQuota, values(srchJobsQuota) as srchJobsQuota, values(cumulativeSrchJobsQuota) as cumulativeSrchJobsQuota, values(title) as userid, values(cumulativeRTSrchJobsQuota) AS cumulativeRTSrchJobsQuota by roles | mvexpand userid | stats values(srchDiskQuota) as srchDiskQuota, values(rtSrchJobsQuota) as rtSrchJobsQuota, values(srchJobsQuota) as srchJobsQuota, values(cumulativeSrchJobsQuota) as cumulativeSrchJobsQuota,values(cumulativeRTSrchJobsQuota) AS cumulativeRTSrchJobsQuota by userid roles just want to get details on current utilization by user/role & more of search concurrency settings (resource utilization etc) ... View more

were you able to find fix solution for this ? ... View more

@PickleRick  how would you use REST in splunkcloud indexers? isnt it restricted to SH only ... View more

Hi @gcusello , it was setnull stanza which was being used by another app and was taking precedence over this one that is why it was not taken into consideration . i changed the setnull stanza in tranforms to a more meaningful & unique name and that worked .. Thanks a lot for your help. ... View more

Hi @gcusello , it does , we are doing indexer level props & trasnforms for other sourcetypes as well & it is working fine.  document also says the same Manage private apps on your Splunk Cloud Platform deployment - Splunk Documentation "When you install an app using self-service app installation on Classic Experience, the app is automatically installed on all regular search heads and search head cluster members across your deployment. The app is also installed on indexers" ... View more

Hi @gcusello , created the add-on using addon builder and uploaded it on splunkcloud SH. in classic experience it is deployed on the indexers as well. ... View more

Hi @gcusello  yes UFs  ... View more

i dont have any HF in my environment, so i kept it as custom app on cloud indexers. ... View more

@gcusello  its not dropping those DEBUG ones props- [risktrac_log] LINE_BREAKER = ([\r\n]+)\[\d{2}.\d{2}.\d{2}.\d{2}.\d{2}.\d{2}.\d+.\w+ MAX_TIMESTAMP_LOOKAHEAD = 35 SHOULD_LINEMERGE = 0 TIME_PREFIX = ^ TRUNCATE = 99999 pulldown_type = 1 TRANSFORMS-null = setnull   transforms- [setnull] REGEX = DEBUG DEST_KEY = queue FORMAT = nullQueue ... View more

@gcusello thank you,  yes i am keeping it on the indexer. regarding that a quick query , its a cloud environment(classic) & i am keeping props&transforms on the splunk cloud indexers , if we drop these events from splunkcloud indxers using props&tranforms would it still count against SVCs? I am asking this because the null queue would happen after parsing so the processing is happening. in on-prem as far as i know it wont count against licensing because indexing wont happen, how does it work in splunkcloud ... View more

previously i had only DATETIME_CONFIG=CURRENT but i was still getting timestamp parsing error in data quality dashboard , so i added TZ later. ... View more