Hello, I need a restrict role for only upload data file. I add this capability : edit_monitor - Required to make the "Add Data" option show up in the settings menu. indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file. edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang. search - Required so the user can preview the uploaded file.   But the settings are not visible then. The goal is to create a limited access account with only the rigth to upload data, nothing else. Is it possible ?     Thanks for your help.   SPlunk version 8.1 ... View more

Hello, this is my query : (index="uno") OR (index="secundo" earliest=-36mon) |fields Closed_Date Incident_Number Description Up Overal IDno |eval ID=coalesce(Incident_Number, IDno) When the dashboard is loading, it is in Fast mode and don't show the good result. The good result appears in Verbose mode. Some fields of the index secundo are empty when the fast mode is used and filled in verbose mode. I don't get it : with or without "fields" the result is the same, why ? Thanks for your help. ... View more

Hello, everyday I have an email with an Excell file attached. To input the data in Splunk, I have to save the file, convert the file in csv then add it to Splunk. Is it possible to do this action automatically ? ... View more

I have a CSV with 10 values for the field ABLA. In my events I have a field ALIAS and I want to display on a dashboard the count of events with the ALIAS matching ABLA by time. index="events_index" | append [| inputlookup CSV.csv |stats values(ABLA) as liste] | where alias IN liste How can I do that ? ... View more