About HumanPrinter

jkat54 · ‎10-26-2023

Check this server.conf setting that you may be missing: goes under sslOptions sslCommonNameToCheck = <commonName1>, <commonName2>, ... * If set, and 'sslVerifyServerCert' is set to "true", splunkd limits most outbound HTTPS connections to hosts which use a certificate with one of the listed common names.

youngsuh · ‎09-27-2021

I'd have documentation how to generate the certificate and distribute using DM. Thus your communication with UF is done with SSL. Would you be interested in bash script and how to deploy? Or have you done that already.

lweiss · ‎05-21-2021

Hi @muhammadamir This is a known issue with v7.3.6; we ran into it at my company when we upgraded. To resolve the problem you'll need to add the "admin_all_objects" capability to anyone that needs to send an email alert. There's more info about the issue in the release notes: Known issues - Splunk Documentation Good luck!

mdsnmss · ‎01-21-2020

I'm going through something similar in my environment and it just takes some planning for a switchover. It also depends on how you have your certificates configured. If you have a unique certificate for each forwarder than it is certainly much more painful. A common configuration is to use wildcard certs for forwarders and unique for all servers. Create new certs alongside the old ones and update paths in your configs to point to the new certs without restarting Splunk. Then it is a matter of updating the deployment server to push new certs to each forwarder while also rolling indexers and search heads with CA changes simultaneously allowing those configs to take effect. Likely a brief outage would be required but shouldn't be extensive. You can also temporarily disable the SSL settings while the switch is being made. It definitely isn't easy and done wrong can break your entire Splunk environment.

HumanPrinter · ‎09-26-2019

We are running a Universal Forwarder on our Windows servers which host several of our application. Each application logs to the same Windows Event Logbook, but use different sources to be able to determine the source of the logging. We have configured the UF to forward all messages from the logbook to the heavy forwarders according to the inputs.conf-snippet below: [WinEventLog://ServerApps] disabled = 0 sourcetype = ServerAppLogs source = ServerApp renderXml = false The problem is, whenever a new application is deployed, it will register a new source with the Windows Event logbook (using Powershell: [System.Diagnostics.EventLog]::CreateEventSource($eventSourceName, $eventLogName) ). But the UF does not pick up this new source untill it is restarted even though we did not specify any whitelisting or blacklisting. Is it possible to make the UF listen to new sources in the Windows Event Log without having to restart it? PS. We are using version 7.3.1 of the Universal Forwarder

HumanPrinter · ‎11-01-2018

The problem turned out to be very simple and very obvious. I was forwarder to the deployer of http instead of http s. In other words, changing proxy_pass http://splunk_deploymentserver; into proxy_pass https://splunk_deploymentserver; did the trick. (That was one expensive letter 🙂 )

Posts	11
Solutions	2
Karma Given	1
Karma Received	1
Member Since	‎10-26-2018

Online Status	Offline
Date Last Visited	‎05-09-2023 04:32 AM

When enabling sslVerifyServerName for kvstore, the...

Configure Splunk forwarding on Windows hosts to us...

Email action for alerts no longer works since Splu...

Replace root CA for Splunk cluster

Universal Forwarder requires restart after registe...

How to setup an NGINX-proxy for deployment

Re: When enabling sslVerifyServerName for kvstore,...

Re: Configure Splunk forwarding on Windows hosts t...

Re: Email action for alerts no longer works since ...

Re: Replace root CA for Splunk cluster

Universal Forwarder requires restart after registe...

Re: How to setup an NGINX-proxy for deployment