The most foolproof way to accomplish this would be to create a role that has no search permissions.
Then, create the dashboards from reports that are ran/updated every 5 mins, or so.
... View more
@gkumarashanmugam
Are you by any chance using the trial version ?
Also as @richgalloway had suggested, try restarting the splunk instance after modifying the authorize.conf.
... View more
I don't see anything wrong with the time either. It may help if you included a screenshot or something. Both timestamps are 11:28:09. What's the issue?
... View more
SH clusters don't have multi site awareness, but you can still distribute the members of a SH Cluster over multiple physical sites. You just need to be a bit careful to prevent captain election issues during a site (or inter-site-connection) failure.
For more info and some very important considerations regarding site failures and captain election see: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/DeploymultisiteSHC
... View more
I have installed new app IP reputation , but not getting any data , Do i need to change any configurations or search query on this.
All the panels getting error like "search is waiting for input"
... View more
The issue got resolved now , I have installed new app and the permission of that app is root , After changing the permission ,I from root to appropriate sudo user,then i just stopped and started the splunk services , the issue got resolved
... View more