Hello Everyone,   I need help because I have issues with collect command and with data from LDAP (collected with ldapsearch command). My goal is to collect data from ldap with command "| ldapsearch domain=default search="(&(objectClass=user))" attrs="<attribute_list>" " and index it in "ldapdata" index. For this purpose I wanted to use collect command "| collect index=ldapdata sourcetype=ldap". From ldapsearch i get events: _raw1 = {JSON 1} _raw2 = {JSON 2} _raw3 = {JSON 3} . . . _rawN = {JSON N} After collect command I get this events as one big event in ldap index ($ is end of line): _raw1 = {JSON 1}${JSON 2}${JSON 3}$...{JSON N}$ Can somebody advise solution on how to index mentioned data in the index as separated JSON events? Thanks for your help! ... View more

Hello, Can anyone help me to find the issue and fix it? I need to grant permissions to use rest command to power role. I want to list users and roles assigned to them for monthly control purposes: | rest /services/authentication/users | fields title roles | rename title AS user | search roles IN (power admin ess_analyst) | stats values(roles) as roles by user The control performer is user who has a power role and when we are running the same query i am collecting much more entries than he is. What capability is missing? Power user capabilities: accelerate_search can_own_notable_events change_own_password dispatch_rest_to_indexers edit_analyticstories edit_glasstable edit_notable_events edit_search_schedule_window edit_sourcetypes edit_statsd_transforms edit_tcp edit_tcp_stream edit_timeline embed_report export_results_is_visible get_metadata get_typeahead input_file list_inputs list_metrics_catalog list_search_head_clustering output_file pattern_detect request_remote_tok rest_apps_management rest_apps_view rest_properties_get rest_properties_set rtsearch run_collect run_mcollect schedule_rtsearch schedule_search search search_process_config_refresh ... View more