About akai

akai · ‎04-27-2026

Hello, I have a requirement where I need to have the name of the current running saved search available to itself. And to avoid human error, I am looking for an automated way of doing this. Based on this question, I can use | eval search_name="$name$" and it works fine, but I was looking into a way of putting that inside a macro. Unfortunately, when doing that, search_name ends up with the literal value "$name$". Is anyone doing something similar and has a solution? Thank you

akai · ‎09-29-2025

Hello @livehybrid, Thank you for the tip on making the searches, I should have thought about doing that myself first. I set up three searches, with throttles at 1d/24h/86400s. All three searches fired around the same time every day, so either I miss-understood what I was being told or the person was mistaken. Thank you for the help.

akai · ‎09-05-2025

Hello all, Is there any difference between setting a throttle window of 1d, 24h, 1440m or 86400s? I was told that it's better to specify it in seconds because of how the throttling system works. Like if you specify 1d, it will trigger the next day, not actual 24 hours later. I hope that was clear.

akai · ‎08-22-2025

After changing some more permissions and also changing the status transitions permissions (which took me forever to figure out I needed to do), everything seems to be working when inheriting the ess_user role, which is fine by me. I'm still not sure why this is necessary, but I can live with it for now.

akai · ‎08-21-2025

Hello @PrewinThomas, I went ahead and set the inheritance for ess_user, and now I can see the notables on Mission Control with a user with the custom role. Unfortunately, this doesn't fix the root issue, which I think is more in-line with what @livehybrid mentioned, because even granting additional permission to own notables I still get errors when assigning the notables. I would rather not inherit ess_analyst because it has permissions that I do not want to grant to this role.

akai · ‎08-19-2025

Hey @livehybrid, Thank you for the quick response! As far as I can see the permissions on lookups and knowledge objects owned by ES are shared globally with Read all, so I assume at least being able to get the notables populated in Mission Control should be happening, as I mentioned, searching in the notable index does return data (the role also has access to index=*). Anything specific I could check here? I am not sure if anything shows up in the internal indexes, regarding errors or whatnot. EDIT: I would also add that I attempt to clone ess_user, but that did not change the result.

akai · ‎08-19-2025

Hello, I have create a custom role and assigned the same permissions as ess_user, including adding it to the enforce_es_permissions setting. But for whatever reason the user doesn't see any notables on Mission Control (I get a Search did not return any findings or investigations). User also has access to the notable index and can see the events there when doing a normal search. If I assign the ess_user role to the same user, the Mission Control panel gets populated. Running on Splunk Cloud. Anything I am missing or tips for debugging permission issues? Thanks!

Posts	7
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎07-14-2025

Online Status	Offline
Date Last Visited	3 weeks ago

Metadata token inside macro

Differences on throttling times

Custom Role on ES

Metadata token inside macro

Re: Differences on throttling times

Differences on throttling times

Re: Custom Role on ES

Re: Custom Role on ES

Re: Custom Role on ES

Custom Role on ES

Join the Conversation