Security

Why does Splunk web give me an ="ERROR">Unauthorized when I configure trusted CA certificates?

dharveynswccd
Path Finder

I have 2 search heads and I've acquired TLS certs from my trusted CA that I'm using to secure web traffic to the search heads. On one search head I configured the web.conf in $SPLUNK_HOME/etc/system/local/ as per documentation. On one search head everything works fine but on the other I am receiving the following error:

Unauthorized

The only way I can get this work is to modify the web.conf in $SPLUNK_HOME/etc/system/default/, which is not the recommended way. Besides, whenever there is a Splunk upgrade that wipes out the settings.

We found out that when Splunk PS set this up last year, this second server did not have a web.conf file in $SPLUNK_HOME/etc/system/local/. I had to copy from the Default directory but something obviously isn't kosher and I am looking for help determining the issue.
Thanks guys!

Tags (1)
0 Karma
1 Solution

dharveynswccd
Path Finder

Figured it out. Apparently Splunk didn't like me copying over an entire directory and modifying it. I deleted the web.conf file, recreated it then copy and pasted in the stanzas from a sample file. That worked fine.

View solution in original post

0 Karma

dharveynswccd
Path Finder

Figured it out. Apparently Splunk didn't like me copying over an entire directory and modifying it. I deleted the web.conf file, recreated it then copy and pasted in the stanzas from a sample file. That worked fine.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...