I am trying to configure our web interface to have a certificate for connections (i.e. https://fqdn:8000). I am running into a problem where I am getting an "can't read certificate file errno=33558531 error:02001003:system library:fopen:No such process" This is followed with ERROR HTTPServer - SSL context could not be created - error in cert or password is wrong ERROR HTTPServer - SSL will not be enabled Using the SPLUNK documentation on generating this certificate (https://docs.splunk.com/Documentation/Splunk/6.6.4/Security/Getthird-partycertificatesforSplunkWeb) I generated a key file with a pass phrase. I followed the instructions to remove the passphrase and was able to verify this using openssl ..... -text without being prompted. I did deviate slightly when generating the certificate request by using the following openssl command. openssl req -new -sha256 -nodes -out -key -config The config file contained the relevant information and the SAN's we need for the certificate. I had the certificate signed by our Internal CA and I was provided a PEM format (.pem) response. I also had our Internal CA provide the certificate chain in a PEM format. Our certificate chain comprises a root, intermediary and issuing CA. I created a new PEM file and copied the response certificate block in. I then copied the certificate block for the issuing CA, the intermediary CA and then the root CA to this new PEM file. So this mimics what the document indicates (signed cert first, then issuing, then intermediary, then root) I then updated the web.conf file to reference these entries by configuring it as [settings] enableSplunkWebSSL = true privKeyPath = \etc\auth\myfolder\file.key serverCert = \etc\auth\myfolder\signedfile.pem I did also try [settings] enableSplunkWebSSL = true privKeyPath = \etc\auth\myfolder\file.key caCert = \etc\auth\myfolder\concatenatedfile.pem I did also try not using the concatenated PEM file and just using the response file. However no matter what I do I keep getting the error mentioned. Note the certificate being generated is using a CNAME for the FQDN instead of the server name. Do I need to add an additional SAN for the server name as well? ... View more

I am trying to create a fairly static dashboard that shows a license day count down timer. I have the following CSV file with the following fields Application Service, License Expiry Date For example, the data looks like this (date,month, year) ApplicationX, 31/12/2018 ApplicationY, 01/01/2019 What I am trying to do in SPLUNK is show a dashboard that looks like this: ApplicationX | Number of Days to Expiry The file is monitored for any changes. This is the code I have written: index="app_licensing" | eval timenow=now() | eval CurrentDate=strftime(now(),"%d-%m-%Y") | eval Expiry=strptime("License Expiration Date", "%d-%m-%Y") | eval "Expiry Time Left"=CurrentDate-Expiry | table "Application Service", "Expiry Time Left" OR index="app_licensing" | eval timenow=now() | eval CurrentDate=strftime(now(),"%d-%m-%Y") | eval Expiry=strptime("License Expiration Date", "%d-%m-%Y") | eval "Expiry Time Left"=CurrentDate-Expiry | stats count by "Application Service", "Expiry Time Left" However, when this gets displayed, I do not see anything in the "Expiry Time Left" column or any data in the second stanza. Where have I gone wrong? ... View more

I downloaded the application "Alert Manager" and have been able to successfully configure alerts for my searches. Strangely enough I have come across a weird issue that has left me scratching my head as I can't determine what is causing my issue. This comes down to a couple of alerts I am trying to alert on. The alerts I will indicate here are (A) Windows EventID 1102 ==> when a security log is cleared (B) Windows EventID 4720 ==> a local user account is created (C) Windows EventID 4732 ==> a local user account is added to a local group (such as Administrators) I can perform my search in SPLUNK and I am using standard TA's for Windows and I can find these alerts without a problem. My searches are as follows: For (A) ==> index=wineventlog sourcetype=wineventlog:security EventCode=1102. The relative time frame I am using is "Last 24 hours" For (B) ==> index=wineventlog sourcetype=wineventlog:security EventCode=4720. The relative time frame I am using is "Last 24 hours" For (C) ==> index=wineventlog sourcetype=wineventlog:security EventCode=4732. The relative time frame I am using is "Last 24 hours" For (A) I saved the search as an Alert and configured it as follows Enabled = Yes Permissions = Shared in App Alert-Type = real-time Trigger Condition = Per-Result Action = Alert Manager with a "title", impact=High, Urgency=High, Owner=unassigned When an event occurs for alert (A) I immediately get an alert showing the Alert Manager tool. However if I configure an alert for alerts (B) and (C) with the same parameters this doesn't work. The log exists in the index but Alert Manager doesn't work. I am not sure why this is occurring. Any insights? ... View more