Quick question regarding version 2.2 of DECRYPT https://splunkbase.splunk.com/app/2655/
Why does the commands.conf have a local=true under the decrypt command?
It did not have this previously and it still has streaming=true...
It shouldn't have been set. This has been fixed in 2.2.1.
View solution in original post
local = [true|false]
* If set to "true", specifies that the command should be run on the search head only.
* Default: false
It shouldn't have been set. This has been fixed in 2.2.1 <<<
meaning, @mjz , the document needs an update, pls suggest.
Thanks, I had already put in an override into the local directory but I'll upgrade to 2.2.1 soon