Did you ever get any where on this issue? I have the same symptom (NET::ERR_CERT_COMMON_NAME_INVALID) but I have a different error in my splunkd.log Just in case anyone is wondering, the error I'm getting is "WARN HttpListener - Socket error from 127.0.0.1:6252 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number" ... View more

I think I found the issue. We recently updated to Avast Business Pro antivirus. This version has it's own firewall that DID NOT copy existing exceptions from Windows Defender firewall. Creating exceptions in Avast did not resolve the issue. After several posts on the Avast help forum, the easiest (only?) way to fix this is to turn off Avast firewall and revert to Windows Defender firewall. After doing this, Splunk works as intended until Avast is restarted and automatically re-enables the firewall. To prevent this you must (from the Avast management console) create a new settings template with Avast firewall disabled and apply it to the Splunk server. Hope this helps others that may run in to this same issue. Happy Splunking. Splunk>Your data. ... View more

Hello, thank you for the response. I did find that information but it does not answer all of my questions. I was hoping to find more documentation on the configuration macros. In particular the "network_traffic_dvcs" macro is not populating the device drop-down list. ... View more

I have emailed Dell on this but no response yet. I found another post which matches what I am experiencing. Read it here. https://answers.splunk.com/answers/512018/why-does-searching-indexsonicwall-only-returning-t.html The jist of it is that Sonicwall seems to be only sending IPFIX template ids of 555 (tid=555). So it would seem that this is an issue with the device its self. Syslogging seems to work fine but if we don't get this resolved before our next purchase window we will probably replace this SonicWall with a Cisco ASA device. If I get a response from Dell I will add it as an answer. ... View more

Swicthing to a different port as jcoates suggests, worked for me. I was having a similar issue. Syslog sending to Splunk was setup and working in Splunk. Data was being indexed and everything was working fine. Later, for reasons not related to Splunk, syslog sending was turned off, on the devices. After turning syslog sending back on, no data was being indexed. Switching to a different port for syslog made it work again. P.S. I forgot to say THANK YOU! ... View more

Tried to give you points for this answer but I don't have enough. That cheat sheet is solid GOLD! ... View more

Trying to get splunk setup and actually working has been a very frustrating experience. I have not found any guides that gives you step by step in the same document. I start reading one, it tells me, go read this other thing. I go read that, and it tells me go read something else. No where in any of the things I read did it say anything about opening firewall ports on the indexer. But that was the problem. Opened port 9997 TCP and now it is active. But when I go to the "add data" page and click forwarders it still shows none. It also says, "There are currently no forwarders configured as deployment clients to this instance." GRRRRR! Then what have I been setting up for the last 4 hours? If it is required then why didn't the installer do it? Or at least ask, if I want it to do it for me. Or even give a "Hey don't forget..." message. Based on my experience I will be recommending that we look at a different solution that is easier to implement. I DO NOT want to repeat this experience at our other 2 sites. ... View more