Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Outputs.conf sslPassword not hashing for speci...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a test environment with similar devices (Windows 10 laptops that serve the same purpose and have the same software) that I'm using to test the SSL configuration for the input-outputs of log receiving/forwarding between Universal Forwarders and one Indexer (both version 6.5). The issue is that for some devices, once the Universal Forwarder is installed and they point to the Indexer (which is set up as a Deployment Server as well) to pull the app that contains the testing SSL configuration for outputs.conf, certain devices do not hash the sslPassword when the UF restarts, while others do. So all devices are phoning home and are listed under Forwarder Management, but only some are sending logs, while the rest (that are not hashing the sslPassword) can't send any logs.
What is going on?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All the behaviors you describe, especially the lack of password hashing, generally indicates that Splunk is unable to access the file.
Verify that your Splunk user has access to the file(s) and that they are not set to read only.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All the behaviors you describe, especially the lack of password hashing, generally indicates that Splunk is unable to access the file.
Verify that your Splunk user has access to the file(s) and that they are not set to read only.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any progress?
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah that was it, I figured out that when I installed the UFs, I forgot to run the installer as administrator in some of them, which happen to be the ones that were failing to hash the password.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to hear you were able to resolve it.
An upvote would be appreciated and Accept Solution if it helps!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
