jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, RSA keySize < 1024 Just as a followup, performing this change to allow RSA keysizes of 1024 bits worked fine and when combined with explicitly specifying encrypt=false in the JDBC URL we now have working connectivity.  ... View more

I have hit this problem too, and it's a bit awkward. Here's what I have learned: - Even with encrypt=false in your JDBC URL, authentication still occurs over TLS. - MSSQL 2014 uses 1024-bit keys by default - Newer versions of JRE/JDK (not sure when it changed) specify minimum key lengths of 2048 for RSA I am working to solve this by having the MSSQL team configure suitable certs signed by our PKI. As a temporary workaround you may be able to set this: #$JAVA_HOME/lib/security/java.security jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, RSA keySize < 1024 Notably, we are changing the disabled RSA keySize to <1024, which would allow the 1024-bit keys used by default in MSSQL14 -- even when SSL is explicitely disabled in the JDBC URL. ... View more

Hello @gcusello  I am performing the cloning from a source indexer, not from a uf. This means there is currently no outputs.conf configured, and your answer does not work. Thanks   ... View more

i mean 8.2.6, answers won't let me edit ... View more

Still happening in 7.2.6 June 2022 😞 ... View more

I mean literally delete the triggered alert. In the UI there's a button to delete them, in the REST API there's an endpoint to delete them. I would like an option to delete them if events occur as I described in OP ... View more

It is almost certainly not possible natively, sorry! ... View more

Nothing above the normal requirements for a standalone search head -- so just include the default set of apps as normal and you're fine. Search head cluster logging information largely goes to index=_internal and other pre-existing default indexes. ... View more

The answer by mdessus describes how to detect this issue. Firstly, the ES Identity and Assets are merged every 5 minutes as a modular input, that explains why sometimes it will happen instantly and other times it can take a few minutes: http://docs.splunk.com/Documentation/ES/4.1.1/User/Identitymanagement#Merging_the_asset_and_identity_lists What worked for me was the following: Background: you have a lookup, ad_identity_list that is silently failing to load in to ES. The lookup is populated with good data, you've checked the logs for modular inputs and have seen that the merge is running properly, but no data Identity data is being populated in ES. Make an interim lookup, called something like ad_identity_interim. Copy whole ad_identity_list into ad_identity_interim. Execute the following, to place only a few entries into the Identity lookup ES is trying to merge. | inputlookup ad_identity_interim | head 5 | outputlookup ad_identity_list Wait until the merge occurs and you should see the five entries in your Identity Center. Continue adding incrementally until you have the whole list in there, making sure you wait for the merge to occur between each execution. | inputlookup ad_identity_interim | head 50 | outputlookup ad_identity_list | inputlookup ad_identity_interim | head 100 | outputlookup ad_identity_list | inputlookup ad_identity_interim | head 500 | outputlookup ad_identity_list | inputlookup ad_identity_interim | head 1000 | outputlookup ad_identity_list You should now have all your identities in ES. I'm unsure as to why this works, but the issue has occurred and this fix has worked for me in several completely different architectures. It seems as though once the initial list has populated that the updates to the lookup are loaded properly, so I haven't had to make a chain of saved searches to behave as described above; it works as expected once it's all initially loaded -- noting that I have only ever made minor changes on an ongoing basis. ... View more

You can place the TOR exit node list into a CSV then at search time use an inputlookup like so: index=firewall [|inputlookup torexitnodes.csv | fields exitnodeip ] Because Tor exit nodes change constantly you will probably need to have this CSV automatically updated by a script. ... View more

You're gonna have to escape the rogue quote. field1",field2", "field3-sdasds"textdata blah blah\" ", "field4-#$%232" Any quote that's supposed to be ingested as data rather than a delimiter should be escaped by whatever software is constructing the logs. ... View more

makemv suited my purposes. An arbitrary number of fields should be scalable. Your solution would be a bit messy if there were thousands of "tasks". Thanks though! ... View more