Deployment Architecture

Why can I not find pass4SymmKey for server.conf?

POR160893
Builder

Hi,

I have recently got a standalone instance of Splunk on AWS and it is not fully configured yet.
I am trying to set up my server.conf on $SPLUNK_HOME/etc/system/local but I cannot locate the pass4SymmKey.

When I try and find it on the Splunk GUI, I receive the following:

POR160893_0-1673010408329.png

 



Can you please help?

Thanks

Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

For starters as a general installation guide - https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/Whatsinthismanual

Just try to understand stand-alone installation. Then try to install two instances and make one a search peer of another - that's basically what indexer and search-head are described in a most simplified way.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Oh boy, there are so many things going on here.

"splunk --show decrypted" is a command you type in CLI on the server, not in the UI.

Since you don't have the encrypted pass4SymmKey, you have nothing to decrypt.

Question is which pass4SymmKey you're talking about and what you need it for.

Your instance does not have a valid license.

Have you ever installed/configured any Splunk instance? If not, download a trial version and try to get it running in some testing environment before trying to fiddle with any production evironment!

POR160893
Builder

OK, so that is my weekend work then: Configuring a trial deployment on my personal computer.

MY only qualm with that though is ..... is there a set of steps on what to do and in what order when installing Splunk, configuring indexer and forwarder and search head. I ask as I have all the notes but just do not know the SEQUENCE of steps to execute this ..... 😞


Can you offer any advice please?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

For starters as a general installation guide - https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/Whatsinthismanual

Just try to understand stand-alone installation. Then try to install two instances and make one a search peer of another - that's basically what indexer and search-head are described in a most simplified way.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...