Did you find the cause of this problem? I have created a realtime dashboard and on my 4.2.2 search head I get this error as a normal user but not as an admin. If it access the dashboard from my 4.2 (flat) indexer then it works as the normal user. Cheers David ... View more

You can solve this by specifying the time format Splunk should be looking for in props.conf. Right now in your installation Splunk breaks out a new event whenever it sees something that can be interpreted as a timestamp (which is the default behaviour), so by explicitly telling Splunk what the timestamp looks like it will only look for timestamps in that format. Something like this should go into your props.conf (like $SPLUNK_HOME/etc/system/local/props.conf): [yoursourcetype] TIME_FORMAT = %d %b %Y %T ...where you should exchange yoursourcetype for the actual name of the sourcetype you're using for these logs. This will match "17 Jun 2011 13:59:13" but not "2011-06-17 13:59:13.685 EST", so Splunk will not break the event. ... View more