Hello everyone, I am facing an issue related to a Splunk user role. A role was created with access to indexes 1, 2, 3, and 4, and all members assigned to this role were able to access those indexes successfully. Later, access to another index (index 5) was added to the same role. However, the users assigned to the role are still unable to access index 5. Has anyone encountered a similar issue or knows if there are additional steps required for the updated index permissions to take effect? ... View more

Why do we find postgres in /apps/splunk/splunkforwarder/quarantined_files/bin/postgres even if we have upgraded to 9.4.3. Splunk must have moved this? If yes why?   ... View more