A late follow up to this. Updating the certificate made no difference. I am using a third party certificate and it is current and valid. To "fix" it, I backed up my splunk configs, deleted the drive, reinstalled, and put the configs back again. Now it works. Something about the 8 to 9 upgrade just doesn't work. Reinstalling is easier than finding out what went wrong. Fortunately I only have to go through that once. The 9.x updates have not given me any further trouble. ... View more

Anyone figure out why? I'm having this exact same issue. ... View more

I am having the same issue.  Any ideas on how to fix this issue?  ... View more

Me too   Any fixes for this?    ... View more

Same thing happened to me after updating splunk -- lookup_editor was blank across the entire SHC. Manually restarting search heads resolved it. Thank you. ... View more

Added the following capability to the "admin" role                 upload_lookup_files  now I can edit the lookup tables.    ... View more

Does anyone have any additional information about the Graph API input in the O365 add-on?  ... View more

Any updates? Where can I get this beta version 2.0.8?  ... View more

Hi, Is the certificate got replaced from azure end? If it is for every new certificate the API key will change. Check the API was same or not in Azure and compare it with your Splunk configuration. ... View more

I just found this youtube video by a Tenable engineer.  Here is the link to the video:  https://www.youtube.com/watch?v=DFVe_uingxg   It looks like you need to log in via the GUI and click on Analysis>Vulnerabilities tab.  From there, select Vulnerability Detail List and save that as a query.  Name the query whatever you like.  Use that name within the Splunk TA and you should be good to go. ... View more

Hi All, is there a solution for this problem? ... View more

I had the same issue,  this is how I reserved my issue: On  searchhead(s)   in /opt/splunk/etc/system/local/server.conf [shclustering] disabled = 0 mgmt_uri = https://10.0.0.202:8089 replication_factor = 2 shcluster_label = InCorpShcluster01 id = 33DA70FF-FC57-497A-B405-CA85C61EFACE adhoc_searchhead = true current_member_uri = https://10.0.0.135:8089     I had the DEPLOYER =  xxxxx     under the[shcluster]stanza , but read that the KEYc ould be located under the  [general] stanza - so I removed the pass4SymmKey = and restarted  splunk. Deployer /opt/splunk/etc/system/local/server.conf [general]serverName = searchhead2site1 pass4SymmKey = $7$v9H1PDth+5OR0zCD4fnfJOJ8JQ7/sdJd6+vc/jSDRX0v4suiha+Srg== ## bunch of other line configs [shclustering] shcluster_label = InCorpShcluster01   Deployer server ------------------------------------------ [splunk@deployer]lunk/bin/splunk apply shcluster-bundle -target https://10.0.0.202:8089 -auth admin:pssword Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y Bundle has been pushed successfully to all the cluster members. ... View more

If you think you have security problems while opening port to another domain. You can request deployment server license from Splunk support. ... View more

References: https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Distributeddeployment jdk1.1.8.0_131 is a Linux RPM and would be installed on the system like so. Keep in mind that the java rpm would need to be install on all instance that is running dbconnect. rpm -i filename.rpm I have only done single instance installs of dbconnect and not on a SHC, but this is what I've found about installing it on a cluster. 1. It looks like the db connect first needs to be setup on the search head deployer. 2. Download the latest version of dbconnect 3. Download and install jdk as mentioned above. 4. Download and install any db drivers required for your deployment. https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Installdatabasedrivers 5. Logon and ensure that the app is working. 6. Create identities and connections. 7. Copy the dbconnect app from /etc/apps to /etc/shcluster/apps on the deployer. There was an additional mention of two files that would need to be copied over manually from the deployer to the SHC nodes. kerberos_client.conf and identity.dat 8. Issue the deployer command splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password> ... View more

True but how do i know which ones to delete from the license gui (console). they are all named the same: ex Licenses volume expiration Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM No way to know which ones to delete ... View more

According to the documentation: https://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Prerequisites For 3.1.1: Splunk Enterprise This version of Splunk DB Connect is compatible with Splunk Platform versions 6.4.0 and later. So yes, however, looking at the release notes there are numerous fixes, some of them specific to 7.0 and 7.2 which are addressed in later versions. 3.1.4 is the latest DBX, so you may want to consider testing and upgrading to that to avoid such issues ... View more

Great, Glad to have helped! Please accept this answer, and upvote it to help others find the correct answer in the future. all the best! ... View more

Your data is not dropping that's good. whats your splunk version ? are you using splunk default cert for ssl? should be ssl warning / ansible callback 3rd pary callback plugin. Try to use the curl REST to post the data and see the error. If no issues then have to check the callback plugin. ... View more

Not really. It does not support CIDRs but it does support typical wildcarding so you could do 128.88.8.* ... View more

Thanks for the information. Where can i get a copy of a version 6 authorize_roles.xml file? ... View more

It doesn't all have to be in one folder. Just have the HF name somewhere in the path. For example, say currently you have: /opt/logs/typeA/foo.log /opt/logs/typeB/bar.log Just create something like /opt/hf.dmz.com/logs/ as a symbolic link to /opt/logs/ and update splunk inputs accordingly. Which results in source values like: /opt/hf.dmz.com/logs/typeA/foo.log /opt/hf.dmz.com/logs/typeB/bar.log ... View more

Thank you very much!!! ... View more

The same issue just started with our tenable add-on. we were receiving data and now it stopped I restarted the Splunk service on the DCN but still doesn't work Anyone have any additional recommendations? ... View more