Hi, I want to show the number of all my downloads with a Splunk search, but the search shows never all downloads how i want it. Here is my search: index=abc sourcetype=xyz country="USA" | top limit=2000 filetype| rename count AS "number of downloads" For exampel, this search doesn't show the filetype pdf. But the search: index abc sourcetype = xyz country="USA" filetype=pdf |top limit=2000 filetype| rename count AS "number of downloads" show that there are a big number of pdf's and when i change the search to index abc sourcetype = xyz country="USA" filetype=pdf OR fieltype=txt |top limit=2000 filetype| rename count AS "number of downloads" There are NO results displayed With the search index abc sourcetype = xyz country="USA" |top limit=2000 filetype|search filetype=pdf fieltype=txt |rename count AS "number of downloads there are no results displayed too. Did anybody of you know a answer, what ist my fault? I want to show all filetypes, but it is important that the pdf's dont will be ignored. Thank you very much for your help, and sorry if this is to incomprehensible. ... View more

Hi, my customer wants to create field extractions for the whole app. For this he need the permission admin_all_objects, but i don't want to give him this permission, because he shouldn't have access to all other apps. Is there a other way, that he can create extractions for his app? When he create first private extractions and switch the permissions from private to app, other users cant see this. Thank you for any help! ... View more

Hi, i want to hide some tabs in an app of splunk for specific users. My idea was to change the XML-Code, so that i set the tabs invisible. But how i can combine the invisible command with some rolls/user permissions? Thank you very much! ... View more