Thanks for the response. I've tried to add my role to the 'data inputs -> 'app manager' -> 'enforce_es_permissions", but that just gives me an error. Do you have or know of specific documentation of how to set role permissions of a search head cluster?   ... View more

I'm having the same issue as OP, what are the specific conf files that control whether a role get permissions to everything in enterprise security? Thank you. ... View more

I ran a full rebalance, non-searchable, threshold = 95% over the weekend and it seemed to get stuck at 99.72% before i stopped it. Splunk documentation isn't comprehensive enough for troubleshooting purposes and some of the post I've found don't explain anything. I need references that will help me determine what the issue is. ... View more

Restarting did get rid of the message. Thanks for the reminder that a restart is necessary after every change. ... View more

Hello, my deployment server shows 11 errors, however the query doesn't return any results and I have selected all time. Where would I go from here? ... View more

I am collecting all other logs except the papercut from this specific host. The provided query doesn't return anything. I am sure that the service account has read access to the file. What are some other things I can look into that would prevent the UF from collecting a windows file if everything splunk related is correct?   Again, thanks for the assistance. ... View more

I'm collecting papercut logs from a window server. [monitor://C:\Program Files\PaperCut MF\server\logs\print-logs\printlog_*.log] disable=false the output and index are applied via a deployment server. searching with index=* host=<hostname> splunkforwarder service account has read on the folder and children.   ... View more

Thanks for your reply. I'm not 100% sure my assumptions are correct but the config is pretty simple. I'm the admin and I did give the splunk virtual account full permissions. I am searching all indexes for a specific host. The splunk log do have errors but the only lines associated with the file in question are file is parsed and watched. The UF is collecting eventlogs and UF logs. What are some other factors I can look at? ... View more