Deployment Architecture

Why can I not find pass4SymmKey for server.conf?

POR160893
Builder

Hi,

I have recently got a standalone instance of Splunk on AWS and it is not fully configured yet.
I am trying to set up my server.conf on $SPLUNK_HOME/etc/system/local but I cannot locate the pass4SymmKey.

When I try and find it on the Splunk GUI, I receive the following:

POR160893_0-1673010408329.png

 



Can you please help?

Thanks

Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

For starters as a general installation guide - https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/Whatsinthismanual

Just try to understand stand-alone installation. Then try to install two instances and make one a search peer of another - that's basically what indexer and search-head are described in a most simplified way.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Oh boy, there are so many things going on here.

"splunk --show decrypted" is a command you type in CLI on the server, not in the UI.

Since you don't have the encrypted pass4SymmKey, you have nothing to decrypt.

Question is which pass4SymmKey you're talking about and what you need it for.

Your instance does not have a valid license.

Have you ever installed/configured any Splunk instance? If not, download a trial version and try to get it running in some testing environment before trying to fiddle with any production evironment!

POR160893
Builder

OK, so that is my weekend work then: Configuring a trial deployment on my personal computer.

MY only qualm with that though is ..... is there a set of steps on what to do and in what order when installing Splunk, configuring indexer and forwarder and search head. I ask as I have all the notes but just do not know the SEQUENCE of steps to execute this ..... 😞


Can you offer any advice please?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

For starters as a general installation guide - https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/Whatsinthismanual

Just try to understand stand-alone installation. Then try to install two instances and make one a search peer of another - that's basically what indexer and search-head are described in a most simplified way.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...