Why is our Windows Splunk forwarder displaying passwords in clear text in the password file? How do we encrypt it?

[regba123]

On the Windows side, the Splunk forwarder file displays clear text passwords. Can they be encrypted, and how?

Thanks

[koshyk]

I feel It is a bug in Splunk. We have raised numerous cases with Splunk but in vain as the only recommendation they say is to put the password into "etc/system/local" !! We tried putting encrypted password directly into the app, but it didn't work.

If you analyse carefully, the password would have been encrypted and stored in another app's stanza. If you run btool on the client you would see the "stanza" in another app. So the solution is
- take the line of sslPassword out of the app and paste into $SPLUNK_HOME/etc/system/local/.conf
- Find the app which contains the sslPassword stanza which is encrypted. Move the sslPassword stanza to that app

I know, both of them are not perfect solutions.. but we couldn't find any other options.

[mckeon]

Same is happening for me. *nix forwarders are encrypting the sslPassword properly, but Windows forwarders are putting the hashed password somewhere else and leaving the initial configuration sslPassword in clear-text.