I am doing some automation in which I am running some searches through the API, and if any results are found, it emails the link to the job to some users. Everything works as desired except for the fact that, by default, jobs are private so the users do not have access. Is there anyway to programatically change the read permissions to everyone for a job? Thanks ... View more

Hello all, Certain users in our environment seem to be able to run searches utilizing the "sendemail" command while others cannot. I am assuming this due to differing capabilities assigned to their roles. Does anyone know what capability(s) are required to run "sendemail"? Thanks, Chris ... View more

Hello all, I am pulling a simple CSV file. It only has two fields: a url and an identification number. For example: https://google.com, 531 https://amazon.com, 9849 The problem is, Splunk is combining multiple events into a single event, which I do not want. I believe it may be due to the fact that there are no timestamps in the events (I would like for it to just set _time as the index time) and so it is combining events while looking for a timestamp. However, I have tried to correct this by setting DATETIME_CONFIG = CURRENT, and had no luck. The data is pulled from a file on a Universal Forwarder. It then goes to a Heavy Forwarder, which sends it to our indexers. The config files are as follows: UF: inputs.conf: [monitor://C:\UrlFile.csv] sourcetype = url index = security ignoreOlderThan = 7d disabled = false props.conf: [source::C:\UrlFile.csv] KV_MODE = none DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE = false Search Head: props.conf: [source::C:\UrlFile.csv] KV_MODE = none MAX_TIMESTAMP_LOOKAHEAD = 1 REPORT-url = url_extract SHOULD_LINEMERGE = false transforms.conf: [url_extract] DELIMS = "," FIELDS = "url", "id" Any help will be greatly appreciated. Thanks! PS: This question is very similar to the question at this link, https://answers.splunk.com/answers/123998/issues-with-multiple-lines-in-csv-file-being-treated-as-a-single-event.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev, but his data has timestamps whereas mine does not. ... View more

I am trying to upgrade one of our Splunk servers from 6.5.1 to 6.5.2. The way we usually do this is wget to get the rpm file, but when I run: sudo wget -O splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk&filename=splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm&wget=true' I get the following: --2017-02-01 10:31:55-- https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk&filename=splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm&wget=true Resolving www.splunk.com (www.splunk.com)... 54.xxx.xx.196, 54.xxx.xx.56, 54.xxx.xx.242, ... Connecting to www.splunk.com (www.splunk.com)|54.xxx.xx.196|:443... connected. Unable to establish SSL connection. Again, we have done this many times in the past with no issue. I would appreciate any suggestions. Thanks ... View more