Thanks @ben_leung, it works quite well. I checked it with Splunk Enterprise 8.1.2. In this version it's not even needed to set x_frame_options_sameorigin to false. It will be automatically overruled if you're on a domain, which is allowed by the Content-Security-Policy . We use it like this: replyHeader.Content-Security-Policy = frame-ancestors self https://example1.com https://example2.com ... View more

That's unfortunately not possible. The HEC configuration is designed in a way to open just one port with one TLS configuration. These are in the [http] stanza in inputs.conf. DBConnect uses HEC by it's own for indexing extracted data. So DBConnect will always been affected. I recommend not to decrease the security level by removing TLS. I would try to force the source system to get SSL working on their side. Otherwise you need to setup a second HF instance for HEC without TLS. ... View more

UI configuration changes ending in generated config files at $SPLUNK_HOME/etc/system/local/ inside of your container. But some of the configuration are just available by accessing the filesystem e.g. certificate configurations. ... View more

Are the files smaller than the 256 bytes? ... View more

Have a look to the untable command. That might be a good solution. ... View more

Hi Christian, we had a similar problem. It was based on missing proxy configurations in server.conf. The Add-on need these proxy settings instead of splunk-launch.conf. Best, Daniel. ... View more