Why can I not find pass4SymmKey for server.conf?

[POR160893]

Hi,

I have recently got a standalone instance of Splunk on AWS and it is not fully configured yet.
I am trying to set up my server.conf on $SPLUNK_HOME/etc/system/local but I cannot locate the pass4SymmKey.

When I try and find it on the Splunk GUI, I receive the following:

Can you please help?

Thanks

[PickleRick]

Oh boy, there are so many things going on here.

"splunk --show decrypted" is a command you type in CLI on the server, not in the UI.

Since you don't have the encrypted pass4SymmKey, you have nothing to decrypt.

Question is which pass4SymmKey you're talking about and what you need it for.

Your instance does not have a valid license.

Have you ever installed/configured any Splunk instance? If not, download a trial version and try to get it running in some testing environment before trying to fiddle with any production evironment!

[POR160893]

OK, so that is my weekend work then: Configuring a trial deployment on my personal computer.

MY only qualm with that though is ..... is there a set of steps on what to do and in what order when installing Splunk, configuring indexer and forwarder and search head. I ask as I have all the notes but just do not know the SEQUENCE of steps to execute this ..... 😞


Can you offer any advice please?

[PickleRick · Accepted solution]

For starters as a general installation guide - https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/Whatsinthismanual

Just try to understand stand-alone installation. Then try to install two instances and make one a search peer of another - that's basically what indexer and search-head are described in a most simplified way.