After entering the search peer information into the Distributed Search-Add search peers window, I get the following error:
Your entry was not saved. The following error was reported: SyntaxError: Unexpected token < in JSON at position 0.
My URI is:
Then when I try to search "index=_internal sourcetype=splunkd error | head 99", I get the error:
Splunk cannot authenticate the request. CSRF validation failed.
What could the issue be and how should I troubleshoot this one?
A quick note about my server.conf in etc\system\local, the current setting is:
[sslConfig] enableSplunkdSSL = false sslPassword = $1$MhI5x3Z+VX7R
Splunk keeps adding sslpassword even though I have enable splunkdssl set to false, despite stopping splunk to edit the file. At one point, I tried encryption and tried to back out of it when it didn't work as I had expected.
Did you see this answer about browser plugins?
I think I got this error once and I went into the DMC setup page and without making any changes, clicked on save configuration and it fixed the problem.