Splunk Search

CEF app, Create output group button missing in New CEF Output step during CEF output app creation

cku1
Engager

We are trying to use the CEF App, to create a new Output App to be deployed to our two indexers. However during the "Define Output Groups" step of the "New CEF Output" wizard, the green "Create output group" button referenced in the documentation, is missing.

alt text

We are running

Splunk Enterprise
Version: 7.3.0
Build:657388c7a488

Tags (2)
0 Karma

mbjerkeland_spl
Splunk Employee
Splunk Employee

After a bit of troubleshooting where we first thought the issue was with missing role permissions in Splunk, it turned out the KV Store was not running due to an expired certificate. We recreated the certificate using the splunk createsslcommand, restarted and voila, the Create Output Group button reappeared.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...