- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I have 2 search heads and I've acquired TLS certs from my trusted CA that I'm using to secure web traffic to the search heads. On one search head I configured the web.conf in $SPLUNK_HOME/etc/system/local/ as per documentation. On one search head everything works fine but on the other I am receiving the following error:
Unauthorized
The only way I can get this work is to modify the web.conf in $SPLUNK_HOME/etc/system/default/, which is not the recommended way. Besides, whenever there is a Splunk upgrade that wipes out the settings.
We found out that when Splunk PS set this up last year, this second server did not have a web.conf file in $SPLUNK_HOME/etc/system/local/. I had to copy from the Default directory but something obviously isn't kosher and I am looking for help determining the issue.
Thanks guys!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Figured it out. Apparently Splunk didn't like me copying over an entire directory and modifying it. I deleted the web.conf file, recreated it then copy and pasted in the stanzas from a sample file. That worked fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Figured it out. Apparently Splunk didn't like me copying over an entire directory and modifying it. I deleted the web.conf file, recreated it then copy and pasted in the stanzas from a sample file. That worked fine.
