Are there any interesting messages in the error log? index=_internal TA-purestorage-unified log_level=ERROR I tried installing this add-on on a test machine with Splunk Enterprise 9.2.0 and could load the configuration page without error. Which version of Splunk Enterprise are you using? ... View more

Another option would be to create a dashboard with the base search to pull up the errors and then use a drill down to get the rest of the detail. Here is some example simple xml for a dashboard. <form theme="dark"> <label>Error Dashboard</label> <fieldset submitButton="false"> <input type="time" token="timePicker"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal sourcetype IN (splunkd) AND ERROR | table _time index host source sourcetype _raw</query> <earliest>$timePicker.earliest$</earliest> <latest>$timePicker.latest$</latest> </search> <option name="count">5</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <drilldown> <eval token="tok_time_earliest">$click.value$ - 10</eval> <eval token="tok_time_latest">$click.value$ + 10</eval> <set token="tok_index">$row.index$</set> <set token="tok_host">$row.host$</set> <set token="tok_source">$row.source$</set> <set token="tok_sourcetype">$row.sourcetype$</set> </drilldown> </table> </panel> </row> <row> <panel depends="$tok_index$"> <title></title> <event> <search> <query>index=$tok_index|s$ host=$tok_host|s$ source=$tok_source|s$ sourcetype=$tok_sourcetype|s$ earliest=$tok_time_earliest|s$ latest=$tok_time_latest|s$ | highlight error</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="type">raw</option> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>   ... View more

Hi @Manish_Sharma, as I said, it isn't possible to give a partial access to an index, the access grants are on/off. So the only solution is creating a dedicated summary index (without additional license costs, only storage costs) to that role. Only to be more detailed: in Splunk all accesses to indexes are read only: it isn't possible to modify any data in indexes and deletion is possible only having the "can_delete" role, and anyway it's a logical deletion, not physical. Ciao. Giuseppe   ... View more

Hi @Manish_Sharma, if you're speaking of servers using universal forwarder, you can use a search like the following: index=_internal | stats count BY host and check the list with the ones managed by DS. If you're speking of other hosts without universal forwarder, it's alonger search: index=* | stats count BY host Ciao. Giuseppe ... View more