I have added a New SAML group from our organisation Azure AD and assigned a role which was created before with limited privileges/capabilities and access to only 2 indexes. However, users in that group have reported being unable to access the resources. Upon verifying in the users section of Splunk Cloud settings, I noticed that the specific users involved in that group were not assigned their roles. Is there a troubleshooting step I should take? I noticed an option in the SAML settings to reload the SAML configuration, but I am hesitant to click on it. ... View more

If anybody still facing this issues and could not figured out the solution. In my case, I had to change view type.  You can see here there are three options to choose Raw, List, Table. If you want to set JSON syntax highlight by default, you should choose List view.   ... View more

As I've learned recently, there's nothing stopping someone from defining a different Host value in an input, and causing that problematic situation much more quickly and broadly.  This seems like a huge oversight in functionality. ... View more

Sorry, you need sudo setcap 'cap_net_bind_service=+ep' /opt/splunk/bin/splunk as well ... View more

Is the AuthNRequest signed? For some reason, Splunk does not include the ACS URL in unsigned assertions. In your authentication.conf file, set the following attribute: [<saml-authSettings-key>] signAuthnRequest = true   ... View more

Thank you! I can recommend using this solution! ... View more

Ok, I guess we are getting into a semantics argument but I feel it's an important distinction. SAML is based on federations, a trusted relationship between the Identity Provider and the Service Provider. If the Identity Provider is no longer trusted then that trust is revoked by the Service Provider. The point I'm clarifying is that it's the Service Provider makes the authorization decisions, not the Identity Provider. ... View more

All true statements. For this situation, I cobbled together a bash script to hit up all meta files and use sed to replace olduser with newuser, then move the olduser directory from $splunk/etc/users to a safe place for backup. You'll then need to clear search history for the user cuz for some reasons the scheduler will see that and try to auth non-existent users. Finally, restart splunk. The search history clean: echo removing $ORIG_OWNER from SavedSearchHistory collection cuz bug SPL-134750 for sid in splunk _internal call /servicesNS/nobody/system/storage/collections/data/SavedSearchHistory/ \ | grep $ORIG_OWNER | cut -d'"' -f 4 | xxd -plain | tr -d '\n' | sed 's/\(..\)/%\1/g' | sed -e 's/%0a/\n/g' do splunk _internal call /servicesNS/nobody/system/storage/collections/data/SavedSearchHistory/$sid -method DELETE done EDIT: Well that was clobbered. hopefully decipherable ... View more

Can you not just read the $SPLUNK_HOME/etc/system/local/authentication.conf file with your python script? If not then look at using web services to read this file: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/RESTTUT/RESTconfigurations ... View more

I'm receiving these errors in the LTM log, but not sure how to resolve. Jan 15 03:44:03 f5-bigip-n1 info audit_forwarder: audit_forwarder started. Jan 15 03:44:05 f5-bigip-n1 err scriptd[13853]: 014f0013:3: Script (/Common/Splunk-send_stats) generated this Tcl error: (script did not successfully complete: (01020036:3: The requested RADIUS Server (/Comm on/Splunk.app) was not found. while executing "tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth" invoked from within "lindex [tmsh::get_config auth radius-server /Common/$appn ame.app/$radius_ihealth] 0" invoked from within "set obj [lindex [tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth] 0]" line:41)) Jan 15 03:44:05 f5-bigip-n1 notice mcpd[5856]: 0107167d:5: Data publisher not found or not implemented when processing request (unknown request), tag (2901). ... View more

To login with a local user: https://mysplunk.myfqdn.com:8000/en-US/account/login?loginType=splunk ... View more

I have had this issue where one of the certs had expired. In $SPLUNK_HOME/etc/auth/idpCerts, splunk creates a folder called idpCertChain_1 where it breaks apart the cert you pasted (IdP certificate chains--these are the signing certs from your SSO provider--this can often be found in a metadata file from the provider or sometimes they just outright have a way for you to download it) from the setup into various certs and calls them cert_1.pem, cert_2.pem, ... etc. cert_1.pem is the root CA, cert_2.pem would be an issuing CA if applicable--if not would be the main cert from the IdP (fancy name for single sign on provider). You can check the certs out using $SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in cert_1.pem to see when it expires, adding -endate will print that line last like so: $SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1/cert_1.pem -enddate Updating the cert with one that was not expired fixed the issue in my case. ... View more

only at those ones ... View more

From Splunk Support Fri Apr 28 11:24:25 2017 Date: Fri, 28 Apr 2017 17:21:43 +0000 (GMT) From: Splunk Support To: Subject: Case #478790 Transparent Huge Pages aka "transparent hugepages" Splunk warning [ ref:_00D409oyL._5003317y65P:ref ] Hello Garrett - Thank you for contacting Splunk Technical Support. The second post-er is correct; it doesn't matter if defrag is set to never - if you're OK with seeing WARN'ings in the log. We advise to turn off both. Our documentation points to an Answers page that has been verified by Splunk as correct, and it specifically describes turning off both. https://docs.splunk.com/Documentation/Splunk/6.5.3/ReleaseNotes/SplunkandTHP https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html So, run with that and you'll be good to go! Regards, Eric Ryder Splunk Technical Support US Phone: 55-775-8657/855-SPLUNKS Outside US: http://www.splunk.com/view/contact-us/SP-CAAAHJ6 Open a case: p://support.splunk.com/ Case: 478790 Status: Open Priority Level: P3 [ ref:_00D409oyL._5003317y65P:ref ] From Splunk Support Fri Apr 28 11:24:30 2017 Date: Fri, 28 Apr 2017 17:28:12 +0000 (GMT) From: Splunk Support To: Subject: Case #478790 Transparent Huge Pages aka "transparent hugepages" Splunk warning [ ref:_00D409oyL._5003317y65P:ref ] p.s. To clarify my last email: Leaving defrag at "always" does not have a performance impact, but you will see the warning in the log. We don't consider this a bug, because we ask that it also be turned off, per the verified Answers post with instructions. I hope that's more clear. Cheers, Eric Ryder Splunk Technical Support US Phone: 55-775-8657/855-SPLUNKS Outside US: http://www.splunk.com/view/contact-us/SP-CAAAHJ6 Open a case: p://support.splunk.com/ ... View more

Thank you for answer. It was not a problem of Splunk, it was a network problem. I want to investigate the network. ... View more

It looks as if you have some memory issues in the Hadoop nodes, so some of the jobs are being killed. ... View more

Have you tried this fix? https://answers.splunk.com/answers/421957/splunk-add-on-for-microsoft-sql-server-the-lookup.html#answer-421959 ... View more

The only supported Identity Providers prior to 6.5 were: Ping Identity Okta Azure AD ADFS http://docs.splunk.com/Documentation/Splunk/6.4.6/Security/HowSAMLSSOworks 6.5.x introduced support for SAML 2.0. Any IdP (Identity Provider) that can generate a SAML 2.0 compliant SAML response can now be used with Splunk, and we'll be glad to assist. http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/HowSAMLSSOworks ... View more

Does this SAML support team still exist at Splunk? ... View more

thank you! Exactly what I needed! ... View more

In that case I suspect that you have two options: first option) Create a Provider and fix the MapReduce flags (Yarn Servers, etc ..) second option) Create two Provider, one for Streaming only using the above streaming mode, and one for Mixmode (streaming first and reporting second = default ) ... View more

Glad it worked! ... View more

It sounds like there is an issue with your query, but I can't see what it is. Hopefully somebody else can. Glad it's working through the GUI though. ... View more

Use a browser plugin to trace your SAML exchanges: https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/ You will be able to see what URL's Splunk is passing to your IdP. You can then verify if those URLs match the Splunk metadata gave to your IdP. What IdP are you using? ... View more