We got the saml sso working on v8.1.1 and when we migrated to v8.2.4 it works fine. However,  on the fresh install of v8.2.4 we are getting the same error. I tried rrestarting by eplacing the sslpassword with cleartext, It is not fixing the issue. Still the same errot ... View more

good question ... View more

Thanks for the direction! ... View more

I found it with the help of your clue. Thank you! ... View more

Thanks for the direction. The REST API shows all the referenced AD group names. Is it possible to see the splunk role(s) mapping to each these AD groups? ... View more

I found it from the online doc. Thanks again! ... View more

Thanks a lot for the info. I tried both options and got HTTP Status: 200 However, after executing the command, I didn't see the change reflected on the Email Settings of Splunk web UI below. http://splunkserver:8000/en-US/manager/launcher/admin/alert_actions/email?action=edit Maybe I should try different REST path? Can you direct me where to get a list of all REST paths? ... View more

I want to refresh this configuration /debug/refresh?entity=admin/alert_actions Please advise if you know I can achieve the same goal using management port. Thank you! ... View more

I want to refresh this configuration /debug/refresh?entity=admin/alert_actions There is an app called add-on debug refresh but the refresh command takes more than 2-3 minutes to complete. On the other hand, the url completes within 5-10 seconds. ... View more

Thanks for the reply. I was using url to reload some config e.g. /debug/refresh?entity=admin/alert_actions However, I wasn't able to find a way to do this programatically so I started to use this app. Do you happen to know a way to invoke the URI programatically or using CLI command? Thank you! ... View more

Thank you for pinpointing the information. I will need to first find out the key of the entry attribute -- emailAttribute in our firm's AD directory. ... View more

I can confirm user's email address is available in AD directory. However, when I examine the user's attributes under Manager>>Access controls>>Users>>juser, Email address is blank (and uneditable). The user is also unable to edit their own email preferences. Basically, I am seeking a way to manually insert user's email address in some config file under $Splunk_Home/ directory. ... View more

No problem. Thanks for the prompt response in any case! ... View more

I read the online doc -- Configure CSV and external lookups However, I still don't find how the csv file will map e.g. user ID rich with the email address. Assuming the user, rich, runs an interactive search from GUI and sends the job to background. How will he receives an email to richm@myemailaddress.com when the job is completed? ... View more

Is this the link you mention -- http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Addfieldsfromexternaldatasources ... View more

My apology but I can't find the link of the great example at the bottom of the docs. Can you please post again? Your help is greatly appreciated! ... View more

Hi, I configured LDAP authentication, pointing to our AD domain controller. The users get mapped to roles successfully, but I examine the user's attributes under Manager>>Access controls>>Users>>juser, Email address is blank (and uneditable). The user is also unable to edit their own email preferences. I didn't install the app -- Splunk Support for Active Directory. The main reason is because I don't have access to the LDAP window server in my firm. I am wondering if it's possible to manually insert user's email address in some config file under $Splunk_Home/ directory. Thank you! ... View more

Thanks a lot for the answer. In most cases, I will get 1 row with 3 columns - host, heartbeat and scanning. However, assuming "heartbeat check completed" is not in the log due to application error, I will get only 1 row with 2 columns -- host and scanning. How can the alert be triggered in this case? ... View more