All Apps and Add-ons

DECRYPT version 2.2 - why is local=true in commands.conf?

gjanders
SplunkTrust
SplunkTrust

Quick question regarding version 2.2 of DECRYPT https://splunkbase.splunk.com/app/2655/

Why does the commands.conf have a local=true under the decrypt command?

It did not have this previously and it still has streaming=true...

Thanks

Labels (1)
Tags (2)
1 Solution

mjz
Explorer

It shouldn't have been set. This has been fixed in 2.2.1.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust
local = [true|false]
* If set to "true", specifies that the command should be run on the search head only.
* Default: false

 https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Commandsconf

 

It shouldn't have been set. This has been fixed in 2.2.1 <<<

meaning, @mjz , the document needs an update, pls suggest.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mjz
Explorer

It shouldn't have been set. This has been fixed in 2.2.1.

gjanders
SplunkTrust
SplunkTrust

Thanks, I had already put in an override into the local directory but I'll upgrade to 2.2.1 soon

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...