topic Re: indexer discovery - Why is Heavy forwarder clear text password not being encrypted? in Getting Data In

indexer discovery - Why is Heavy forwarder clear text password not being encrypted?

kumaranv — Mon, 09 Jan 2023 16:34:26 GMT

In indexer discovery method, Heavy forwarder clear text password not being encrypted after restart. Please help

gcusello — Mon, 09 Jan 2023 13:23:06 GMT

restart by console viewing eventual error messages, check again and if it's still present open immediately a case P1 to Splunk Support.

Ciao.

Giuseppe

scelikok — Mon, 09 Jan 2023 13:57:30 GMT

Could you please show us your Heavy Forwarder outputs.conf setting (pass4SymmKey masked) ? Maybe there is something wrong with the settings.

kumaranv — Mon, 09 Jan 2023 14:56:09 GMT

It is in home practice

in $Splunk/etc/system/local/outputs.conf

[indexer_discovery:idxpeers]
pass4SymmKey = admin1234
manager_uri = https://192.168.1.180:8089

[tcpout:idxdis]
indexerDiscovery = idxpeers

[tcpout]
defaultGroup = idxdis
indexAndForward = 0

kumaranv — Mon, 09 Jan 2023 15:01:34 GMT

in Master Node:
in .../etc/system/local/server.conf

[indexer_discovery]
pass4SymmKey = $7$1k1xTHTMxuk2ekDYjDOt9oIONOK3MHxxxxxxxxxxxxxxxx=

pass4SymmKey was set to admin1234 and after restart i t got encripted

I hope it should happen to HF pass4SymmKey also

Thanks

kumaranv — Mon, 09 Jan 2023 15:25:56 GMT

In HF, it should be

It works now. Thanks

kumaranv — Mon, 09 Jan 2023 15:45:32 GMT

I used the command
./splunk btool check

to identify error in stanzas in conf

splunkoptimus — Fri, 24 May 2024 08:03:08 GMT

I experienced the same error and I had to change manager_uri to master_uri in outputs.conf of the my HF