What is the role capability required to view all the indexes in splunk cloud settings? We have below capabilities in place accelerate_datamodel accelerate_search acs_conf admin_all_objects apps_backup apps_restore change_authentication change_own_password cloud_internal customer_cases delete_by_keyword delete_messages dispatch_rest_to_indexers dmc_deploy_apps dmc_deploy_token_http dmc_manage_topology edit_authentication_extensions edit_auto_ui_updates edit_bookmarks_mc edit_cmd edit_deployment_client edit_deployment_server edit_dist_peer edit_encryption_key_provider edit_field_filter edit_forwarders edit_global_banner edit_health edit_health_subset edit_httpauths edit_indexer_cluster edit_indexerdiscovery edit_ingest_rulesets edit_input_defaults edit_ip_allow_list edit_kvstore edit_local_apps edit_log_alert_event edit_manager_xml edit_metric_schema edit_metrics_rollup edit_modinput_journald edit_monitor edit_own_objects edit_restmap edit_roles edit_roles_grantable edit_scripted edit_search_concurrency_all edit_search_concurrency_scheduled edit_search_head_clustering edit_search_schedule_priority edit_search_schedule_window edit_search_scheduler edit_search_server edit_server edit_server_crl edit_sourcetypes edit_splunktcp edit_splunktcp_ssl edit_splunktcp_token edit_statsd_transforms edit_tcp edit_tcp_stream edit_telemetry_settings edit_token_http edit_tokens_all edit_tokens_own edit_tokens_settings edit_udp edit_upload_and_index edit_user edit_view_html edit_watchdog edit_web_features edit_web_settings edit_webhook_allow_list edit_workload_policy edit_workload_pools edit_workload_rules embed_report export_results_is_visible fsh_manage fsh_search get_diag get_metadata get_typeahead indexes_edit indexes_list_all input_file install_apps license_edit license_read license_tab license_view_warnings list_accelerate_search list_all_objects list_cascading_plans list_deployment_client list_deployment_server list_dist_peer list_forwarders list_health list_health_subset list_httpauths list_indexer_cluster list_indexerdiscovery list_ingest_rulesets list_inputs list_introspection list_metrics_catalog list_pipeline_sets list_remote_input_queue list_remote_output_queue list_search_head_clustering list_search_scheduler list_settings list_storage_passwords list_token_http list_tokens_all list_tokens_own list_tokens_scs list_workload_policy list_workload_pools list_workload_rules merge_buckets metric_alerts never_expire never_lockout output_file pattern_detect phantom_read phantom_write read_internal_libraries_settings refresh_application_licenses request_pstacks request_remote_tok rest_access_server_endpoints rest_apps_management rest_apps_view rest_properties_get rest_properties_set restart_reason restart_splunkd rtsearch run_collect run_commands_ignoring_field_filter run_custom_command run_debug_commands run_dump run_mcollect run_msearch run_noah_command run_sendalert run_walklex schedule_rtsearch schedule_search search search_process_config_refresh select_workload_pools upload_lookup_files upload_mmdb_files use_file_operator use_remote_proxy web_debug ... View more

Hi guys, Please provide your input on the below scenario. I have some events like below. Here , I want to extract some part of event which is in CSV format and that is starting after "#" till the end of an event and store them in separate new index/sourcetype, either by using props/transforms conf OR using query. I have questions like 1)Is there any way to split/extract some part of an event and store it in separate index/sourcetype? 2)How can I extract only CSV event part and display/View it in table format in Splunk? Final result I need is: Extract CSV format events separately from the below events and display it in table format OR store in lookup file.(Simply, to make it human readable). sample.log: sep-12 02:45:56 This message is received from printer,something like this as a eveent. sep-12 02:46:56 This message is received from printer which is in CSV format.... pname,pcode,plocation,status,header_values,XXX,XXX,XX Abc,1233,city,done,xxx,0, xyz,5768,city1,fail,0,0, mno,7898,city3,done,0,0, . . . . . tno,7459,cityx,done,0,0, sep-1:3 01:45:56 This message is received from printer,something like this as a event. sep-1:3 02:05:52 This message is received from printer which is in CSV format.... pname,pcode,plocation,status,header_values,XXX,XXX,XX Abc,1233,city,done,xxx,0, xez,5718,city1,fail,0,0, kno,7878,city3,done,0,0, . . . . . mno,1459,cityx,done,0,0, Kindly, provide your views. Thanks Mala S ... View more