Hi, I'm receiving syslog flow from Trend Micro Deep Security. After installing the app for Splunk, I would like to check how the fields are populate by it. I've got an issue with the field "DPI_Reason", where I can find the Trend Micro rule number. The field in the raw data is, for example, "502", but the field in splunk is "-502". And it only populate the field with default values like 502 or 504, not with custom rules like 1001234. Thanks Max ... View more

Hi, I made certificates from external CA for all my splunk servers, and that works! No problem, splunk documentation is very clear on it. I use OpenSSL. My problem is that my servers have two or more DNS names. For example, server1.domain.com and web.domain.com for the same server. When I made the server certificate just for server1.domain.com, that works. Same thing, of course, with web.domain.com. But when I made the server certificate for both, with server1.domain.com in commonName field and web.domain.com in subjectAltName field, as OpenSSL documentation says, I've got and error in my browser if I navigate to web.domain.com. It says that the certificate is made for server1.domain.com. How can I do for my certificate working for both dns name? I hope I'm quite clear in my explanations, english is not my native language. Thanks for all. ... View more