I have been able to find searches for roles mapped to AD Groups, but I need to get the indexes those roles are allowed to use.  I'm creating a search to assist in upgrading to a new system.  This mapping will give me the relationships.  I have used:  | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but it only gives me the role and searchIndexes.  I need to map it to AD groups too.  Also, when I went to download that searches content, it did not download all the data. I also used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but what I really need is all three values: Role mapped to AD Group and role mapped to indexes in the same search.       ... View more

This is a note my client sent: I can’t really use the logs from Splunk, because they are spotty.. Think I figured out why it’s missing data though.  From our last meeting, they bumped up the transfer rate from 1024KBps to 2048KBps because the CE was generating too much data.  However, the CE raw logs generate roughly about 75MB/Minute or 1.25MBps raw.  Since Splunk does use compression at ~17%, the 2KBps gets you about 11KBps raw.  The 1.25MBps is roughly 217.6KBps compressed.  Hence, it gives you roughly 5% of the total logs.  To support Openway and prevent dropping any logs, we need to set a conservative rate to handle 110MB/minute raw, which would be ~319KBps. We did set in the limits.conf to the 2048 mentioned above, but we're not certain how to set to a level the client needs. ... View more

I have been trying to put together a dashboard for my clients that shows their usage.  The search I am still having issues with is for Average Daily ingest by index over 30 days.  I want it to show just the average number.  I have found searches that get me a distance, but none are specifically what I need. ... View more

I have tried putting the following in the props.conf file: NO_BINARY_CHECK = true and NO_BINARY_CHECK = 1 and CHARSET=AUTO   But none of these worked.  I did them in the props.conf file.  But when I look at the splunkd.log file, the Splunk still thinks of the file as binary.  How can I fix this?     ... View more

The edit dashboard has the Schedule PDF Delivery grayed out. I am root and have all the permissions I believe I need, but it remains grayed out. I'm on version 7.2.6. I verified that at least admin had the schedulesearch and adminall_objects and it does and even restarted splunk, but the feature remains grayed out. Can anyone assist. ... View more

I have the following from a client: I was about to make is for a new AD group “SplunkCAPSCASPayments” so that they are restricted to data that come from the source logging files //LOGCAPSCASPaymentEDMS//CAPS//CASINmsgprod.log and //LOGCASCAPSInvoiceGL//CAS//CAPSINmsg_prod.log Is this possible? These users would only be able to pull the logs from the one CAPSINmsg_prod.log. How can this be done? ... View more

I have a new client that has files named as follows: xxxx.xxxx.log Splunk is not ingesting them. How can I ingest logs that have that type of naming convention. I believe splunk is only looking at the xxx.xxx and can't match it to the /*.log stanza I have in the inputs.conf. ... View more

I have been asked to install the puppet viewer application into our clustered environment. Reading the install information, it appears that it's speaking about a non-clustered environment. What would be the instructions in a clustered environment and how can I make sure that pushing out new apps from my deployer to the search heads doesn't overwrite anything. ... View more

I am receiving the above error when trying to deploy update and new apps from the Cluster Master to the Indexer Cluster. The aspps do exist in /web/splunk/etc/managed-apps directory structure on the cluster master, but I still get this error. I have reviewed several Answers and none of them have worked for us. Recently we worked on the indexes.conf to standardize some features, I'm wondering if that may have caused it. All we did was remove The repFactor-auto from each index (there are about 35) and put it in the [default] and also removed the maxTotalDataSizeMB from each of the index configuration and put it in the default stanza. Now when we push a bundle, we get the Failed to install app with the application does not exist. Would really appreciate any assistance you can give me. ... View more

My customer has some very large csv files that are only updating about 200 events/rows of the data into Splunk. "As per checking MDMS-001_Meter Reads Requested file have 4,633, but in Splunk it only have 208 events. " How can I get the entire csv file to upload? I am using universal forwarders for the ingest. ... View more

Clients wanted a change in how there data was displayed using the sourcetype they first used. How do I remove all of what they have currently indexed so we don't get duplicate entries? ... View more

Clients are saying they are only seeing 2 days worth of the logs. [name] homePath = volume:primary/name/db coldPath = volume:primary/name/colddb thawedPath = $SPLUNK_DB/name/thaweddb frozenTimePeriodInSecs = 15780000 maxWarmDBCount = 300 maxHotSpanSecs=7776000 maxHotBuckets = 3 maxTotalDataSizeMB = 75000 repFactor = auto ... View more

I have verified that the shcluster (for the SH IP it lists) does have the same pass4symkey password yet I still get the error. The server mentioned was recently added to an existing search head cluster. I verified all the entries in the server.conf file on it against one of my existing ones and they contain the same information. I'm stumped on what to look for next. Can anyone assist? ... View more