Hi jhernandez_splunk, if your concern is about compatibility with most of the browsers, stick with the default settings cipherSuite = HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK . But if you could say 'hey, we will only support the browsers listed here' then you could switch to TLSv1.1 or even TLSv1.2. To get a list of the support TLSV1.2 ciphers you can use this command: ./bin/splunk cmd openssl ciphers -v "TLSv1.2" You can find some information and comparison charts over in the TLS wiki as well. Last but not least, it all depends on your use case and feasibility hope this helps ... cheers, MuS ... View more

Hi veeru_irf, try something like this: your base search here | rex "^(?<myIP>(\d+\.){3}(\d+))" | table myIP If this matches, you can set it up as automatic field extraction so it will be extracted by Splunk directly. Also here is a nice little page where you can test regex stuff hope this helps to get you started ... cheers, MuS ... View more

Hi bleung93, with auditing enabled, every interaction with Splunk -- search, configuration changes, etc -- generates an audit event in the index=_audit . Here is a list of activities that generate audit events: all files in Splunk's configuration directory $SPLUNK_HOME/etc/* files are monitored for add/change/delete using the file system change monitor. system start and stop. users logging in and out. adding / removing a new user. changing a user's information (password, role, etc). execution of any capability in the system. capabilities are listed in authorize.conf Read more about auditing in the docs hope this helps ... cheers, MuS ... View more

Hi crt89, this still works like written by @Hexx. Here is a little test I did: First I created a small search and saved it as myFoo in the search app, it got permission private Next I ran the following command from cli: $SPLUNK_HOME/bin/splunk _internal call '/servicesNS/admin/search/saved/searches/myFoo/acl' -post:owner admin -post:sharing app and changed permission to app by doing so watch out for any possible typos in your command. hope this helps ... cheers, MuS ... View more

Hi, as you already know the cipherSuite option can be set in server.conf, web.conf and inputs.conf. Now each cipherSuite in each .conf file has a different effect. After some testing I will share my results. All test were done on a default Splunk setup using a indexer and one universal forwarder. First lets get the SSL ciphers used by Splunk's openSSL, like this: $SPLUNK_HOME/bin/splunk cmd openssl ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5 So we see Splunk uses as first SSL cipher AES256-GCM-SHA384 . Okay lets verify this... $SPLUNK_HOME/bin/splunk cmd openssl s_client -connect myIDX:8089 | grep Cipher depth=1 C = US, ST = CA, L = San Francisco, O = Splunk, CN = SplunkCommonCA, emailAddress = [email protected] verify error:num=19:self signed certificate in certificate chain verify return:0 New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384 Bingo, we get back AES256-GCM-SHA384 as used SSL cipher. Now we change the used SSL cipher for the Splunk management port 8089, therefore I changed the cipherSuite in server.conf on the indexer to cipherSuite=CAMELLIA256-SHA restarted Splunk and did the above test again. $SPLUNK_HOME/bin/splunk cmd openssl s_client -connect myIDX:8089 | grep Cipher depth=1 C = US, ST = CA, L = San Francisco, O = Splunk, CN = SplunkCommonCA, emailAddress = [email protected] verify error:num=19:self signed certificate in certificate chain verify return:0 New, TLSv1/SSLv3, Cipher is CAMELLIA256-SHA So I changed the SSL cipher successfully. I did more testing on web.conf and inputs.conf and here is effects those changes had: universal forwarder inputs.conf: has no effect web.conf: has no effect as well (which is no surprise at all 😉 ) server.conf: changes the SSL cipher used on the Splunks default management port 8089 indexer inputs.conf: changes the SSL cipher used on the Splunks splunk-to-splunk default receiving port 9997 web.conf: changes the SSL cipher used on the Splunks default web port 8000 server.conf: changes the SSL cipher used on the Splunks default management port 8089 One result of this tests is that one is able to change/define the cipherSuite used on accepting a SSL connection, but I was unable to set/change the SSL cipher used to open a connection. hope this helps ... cheers, MuS ... View more