make sure the krb5.conf is in the path that is provided in the JVM options. If the krb5.conf file is not in the /etc directory, set the following option in JVM Options under the Settings tab: -Djava.security.krb5.conf=/path/to/krb5.conf ... View more

You can overcome this by combining list, like blacklist1 and 2 can combine to 1 like this. blacklist1 = EventCode="566|4662" Message="Object Type:\s+(?!groupPolicyContainer)" ... View more

check your file permissions. this was my problem. chown splunk.splunk -R ... View more