I just upgraded to 9.4 and I got the new 9.3+ warning in SplunkWeb about the alert_actions.conf allowedDomainList setting not being set and that I should fix it. I have now set the list correctly in an app and deployed the app to machine: /opt/splunk/etc/apps/my_app/local/alert_action.conf [email] allowedDomainList = mydomain.com,myotherdomain.com I then restart Splunk and I get no warnings. I then run the command: /opt/splunk/bin/splunk cmd btool alert_actions list email I see the following: [email] allowedDomainList = mydomain.com,myotherdomain.com I then go into SplunkWeb and I do not see the allowedDomainList warning in the messages list - the issue is fixed. I then go into Settings->Server Settings->Email Domains->Allowed Domains and this setting is empty. I would expect to see "mydomain.com,myotherdomain.com" in the setting control. Even when I have set everything correctly and Splunk Btool shows the right setting and I have restarted Splunk , why is the setting not showing up? ... View more

I have an outside SAML system (Okta) which we are using to login to our Splunk system and we are defining indexes for people in different buildings to work against (named after thebuildings). The problem is that people move around from buildings to building and they seem to accrete access to virtually every index (building) and we need to stop this by making sure that everyone only gets the access that they need for their building on its own (so creating and revoking access is all controlled within Okta. The other issue is that our organisation moves buildings quite often (due to the nature of the business). So... I have created the following: Okta User->Okta group Splunk Role->Building Index I need to be able to programmatically make the link of SAML Group->Splunk Role. I can read the link between SAML Group and Splunk Role with the REST API using the information in the following page (using /services/admin/SAML-groups), but I cannot find any documentation about creating  and deleting the links. https://docs.splunk.com/Documentation/Splunk/9.2.2/RESTREF/RESTaccess I know that I can maintain the links using the information the below URL, but not programmatically as yet. https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/Modifyorremoverolemappings Does anyone know how I can do this programmatically, please? ... View more

I am creating a script that uses the CLI to create/delete Splunk roles. So far, I have been successful with creating them in the script when I use the admin user. However, my CISO says that I can't use the Splunk admin user and I need to create a Splunk User (and a Splunk Role) that can create and delete indexes. I have tried adding the indexes_edit capability and when I tried doing the delete as my user, Splunk said that I needed to have the list_inputs capability. i have also tried adding access to all indexes. I am using this document at the moment for my guidance, but it is rather light on detail: https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities The command that i am running is: curl -k -u editor-user:MyPasword1 https://localhost:8089/servicesNS/admin/myapp/data/indexes -d name=newindex I get the following: <response>   <messages>     <msg type="ERROR">Action forbidden.</msg>   </messages> </response> This command succeeds if I use the admin user, but not with my editor user. The current capabilities that I have to my existing editor role are:   [role_editor] admin_all_objects = disabled edit_roles = enabled indexes_edit = enabled list_inputs = enabled srchIndexesAllowed = * srchMaxTime = 8640000 srchTimeEarliest = -1 srchTimeWin = -1   Does anyone know what extra capabilities I need, please? ... View more

Dear All, I am running on Splunk Cloud 9.0.2208.3 as a sc_admin-rolled user and I have created a load of calculated fields as my user for the administrators to see data in the associated Data Models. I have made the Calculated Fields non-private - i.e. in the app/global as appropriate. All is good and others can see the data in the DMs, however, I am leaving the company and they are going to have to delete my user as a part of the offboarding process (plus I don't want to be blamed if someone hacks the system and it was my user, somehow). As a result, I want to reassign my KBOs to the nobody user, so that my user is no longer in the circuit and can be safely deleted, however, when I go into "Reassign Knowledge Objects", I cannot see the Calculated Fields at all. I have made sure that I can see KBOs in all apps and all users and still no dice. Why can't I reassign these KBOs??? How can I do this? Or perhaps, do I NEED to do this? ... View more

Dear All, I have about 100 Splunk UFs at 7.0.1, 7.3.5, 8.1.5, 8.2.5 and 9.0.0.1 and they are NOT being managed by a Deployment Server. I need to get them all managed by a DS at v 9.0.1, so that I can manage my apps remotely and so that I can get around the latest DS security CVEs. What is the oldest Splunk UF that a DS 9.0.1 can manage? The latest version of the Forwarder compatibility document is not available (and it does not cover compatibility between DS and UFs, anyway). Lastly, if I were to deploy a 8.2 DS, then would I be able to control the 9.0.0.1 UF? ... View more