Ok, a word of advise - it's usually better to specify indexes explicitly than to have them as searched by default. Especially with an admkn role! It spares you unnecessary load on your environment for searches in which you haven't specified the indexes and it saves you a lot of debugging when you have different roles with different default indexes and people report mismatch in searches functionality. You have been warned. One additional hint - it's way better to do a quick check with | tstats count where index=rapid7 by sourcetype than index=rapid7 | stats count by sourcetype The first one only checks the summarized indexed fields while yours needs to plow through all events from the index. And there is something that doesn't add up. On Cloud you cannot have the admin user role. You can only have sc_admin (which is a limited admin role). So if you're trying to edit the admin role you shouldn't be able to do so.   ... View more

Investigate the data source to determine why it does not have the AppDomain field.  Perhaps it's not present and perhaps it's present under a different name.  For the latter, add an EVAL or FIELDALIAS definition to map the field to the expected name. I advise against changing third-party dashboards.  Once you do that, it becomes your responsibility to keep the dashboard up-to-date.  Updating the app will not update the dashboard because it will be a local change that overrides the default that ships with the app. ... View more

@AJH2000  Did you try checking with Postman or cURL?" ... View more