I've enabled indexer discovery on my 6.3.1 linux universal forwarders.
3. Configure the forwarders a. Configure the forwarders to use indexer discovery On each forwarder, add these settings to the outputs.conf file: [indexer_discovery:<name>] pass4SymmKey = <string> master_uri = <uri> [tcpout:<target_group>] indexerDiscovery = <name>
I have noticed that the pass4SymmKey is not being encrypted when the server first starts after its been added.
Is this by design or is it a flaw?
Take a look here, specifically the section that states:
Warning: If you configure inputs.conf or outputs.conf in an app directory, the password is NOT encrypted and the clear-text value remains in the file. For this reason, you may prefer to create different certificates (signed by the same root CA) to use when configuring SSL in app directories.
Well this talks about SSL passwords, not
[indexer_discovery:], but I suppose the same logic could apply. I'm a bit confused by this behavior. I understand why there are issues if you stick a password in a "default" directory, but I'm not sure what the issue is with updating entries in the "local" folder.
Does this section address your question?
When you specify pass4SymmKey in clear-text for an app directory in a
Splunk instance (for example: etc/apps/myapp/default/server.conf),
an obfuscated version is written to the local file (in this example,
system/local/server.conf) upon restart. Usually configuration files
in the default directory are read only, and the information is also
written to the local file, which is editable.
A password placed directly into an app's local directory (for example:
etc/apps/myapp/local/server.conf), will be replaced with the encrypted
When the configuration is listed using curl or a splunkd endpoint, the
pass4SymmKey appears encrypted. If the configuration location is read-only,
Splunk software likewise writes to local.
Even stranger, I'm staring at a Splunk 6.1 outputs.conf that has an encrypted
$SPLUNK_HOME/etc/apps/MY_Forwarder_Outputs/local/outputs.conf. So I'm going to disagree with the docs on this point.
On at test I'm running, it looks like the encrypted version is stored under
$SPLUNK_HOME/etc/system/local/outputs.conf instead of under the apps folder where the base setting is located. This seems even more problematic as system/local doesn't get updated.