When I go to SearchHead to edit, it tells me this message (You do not have permissions to edit this configuration) ... View more

It does not retrieve the blacklist, but rather it retrieves some of the whitelist. I want to make it pass through the lookuptable and show the user who is not authorized to enter. ... View more

index="(index name)" sourcetype=source type (host="host1" OR host="host2") | search NOT [| inputlookup (lookup table name ) | table username] action=success | stats values(username) as user ... View more

I have specified a specific index so that we can send the logs to it, but when I search in the search head, there are no logs found. Do I have to specify anything in the Input.conf file? ... View more

I want to connect Splunk to the Linux server, and I downloaded the UF on the Linux server to get the security logs from it. After I created the server class and added clients to it, I downloaded the UF to it and made 2 apps (one for nix and one for main) to receive logs.   When I searched the search head, no logs appeared I think the error is in the nix app. Does anyone know what modifications are required to be made on the nix app so that I can take the security logs? ... View more

I want to connect Splunk to the Linux server, and I downloaded the UF on the Linux server to get the security logs from it. After I created the server class and added clients to it, I downloaded the UF to it and made 2 apps (one for nix and one for main) to receive logs.   When I searched the search head, no logs appeared I think the error is in the nix app. Does anyone know what modifications are required to be made on the nix app so that I can take the security logs? ... View more