+1 It would be great to understand if this is possible/supported. ... View more

I've battled this issue so many times - nclancy, your comment was very helpful, however - I still had some issues. At first, I opted to add the following to $SPLUNK_HOME/etc/system/local/inputs.conf: [applicationsManagement] cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH I believe there's a bug, because after a Splunk restart, the btool debug didn't report the change: $ ./splunk btool inputs list --debug | grep cipher /opt/splunkforwarder/etc/system/default/inputs.conf cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 I ended up editing $SPLUNK_HOME/etc/system/default/inputs.conf and it did the trick. No more SSLv3 errors! If you're at Splunk and can replicate this issue, I'm happy to provide a diag so we can address this bug. Thanks! ... View more

Update the local indexes.conf file as well -- example: /opt/splunk/etc/system/local/indexes.conf [_internal] maxTotalDataSizeMB = 30720 maxDataSize = 1000 tstatsHomePath = volume:_splunk_summaries/_internaldb/datamodel_summary coldPath = $SPLUNK_DB/_internaldb/colddb homePath = $SPLUNK_DB/_internaldb/db frozenTimePeriodInSecs = 31104000 thawedPath = $SPLUNK_DB/_internaldb/thaweddb maxHotSpanSecs = 432000 ... View more

We successfully implemented this creating a custom app in Okta versus using the prebuilt one. If you'd like the how-to, let me know. Thanks! ... View more

This is did not work FYI. There are still date mentions of earliest with -30d in the query which I adjusted as well. Still no dice. ... View more

Thanks for the response - It's been configured this way for about 60-days now. Additionally, it's got a lot of breathing room for max-size. ... View more

Hey there! I've come across a similar issue. Currently have mail notifications using gmail SMTP. Here's what I'm seeing in the splunkd.log: 11-18-2015 12:00:02.633 -0800 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://[omitted]/app/search/@go?sid=scheduler_YW5kcmV3LmhpbGw__search__RMD50d06411b8621c38a_at_1447876800_14745" "ssname=[omitted]" "graceful=True" "trigger_time=1447876801" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_YW5kcmV3LmhpbGw__search__RMD50d06411b8621c38a_at_1447876800_14745/results.csv.gz"': ERROR:root:object of type 'NoneType' has no len() while sending mail to: [omitted]@[omitted].com To mitigate, I've reconfigured the mail settings on the instance. However, this has already happened twice. I'd like to get to the root of the issue. Thanks, Andrew, ... View more