We have Splunk DB Connect 3.4.1 working with out SQL Server databases.  We also have an Oracle database that works over 1521 (non-ssl), but are trying to get it to work over SSL.  We've set up everything according to instructions bet we're getting this error message: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate) So it looks like there's a mismatch in cipher suites between DB Connect and the oracle database.  How can I find out which cipher suites DB Connect is trying to use?  we're using ojdbc8  for Oracle 19 ... View more

I'm trying to set up DB Connect to use Oracle Wallet.  I'm at step 5 under "Connect Splunk DB Connect to Oracle Wallet environments using ojdbc8"   (https://docs.splunk.com/Documentation/DBX/3.4.1/DeployDBX/Troubleshooting), where it asks me to prepend some text in JVM Options.  However, I have two JVM Options,  task server JVM Options and Query Server JVM Options.   Which one should I use?   BTW, I tried adding the text to both and it didn't work. ... View more

I heard that RHEL 7 can have mount points that point to S3...has anyone tried setting that up and placing index buckets on that partition?  Wondering if it's possible or not. ... View more

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this? ... View more

One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer: 03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. ... View more

The disk usage is at 17% and inode usage is at 1%. The error message from Splunk Web says minFreeSpace is 5000 and free space is 85711: 03-03-2020 16:16:48.266 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=85711 is less than 2 x minFreeSpace ... View more

All the ones I ever see is Python. I need one that uses a bash script. ... View more

I have splunk getting data for the other objects, including Processor, but nothing happens for Process. The process stanza: [perfmon://Process] interval = 60 object = Process counters = _Total instances = * index = windows showZeroValue = 1 disabled = 0 The processor stanza: [perfmon://Proccesor] interval = 60 object = Processor counters = * instances = * index = windows showZeroValue = 1 ... View more

I have a splunk cluster (RHEL) with 2 indexers, and they seem to have a memory leak. Memory usage grows steadily until it runs out of memory and the OOM Killer kills the splunkd process. The only way to get the memory back is to restart the server (restarting splunk doesn't help). I've got two clusters that do this, and a few single instance splunk servers that never do this. Oddly enough, it's usually one of the indexers in the cluster that eats up memory first. ulimit and THP is set properly on all the servers. Has this happened to anyone? ... View more

I just installed a new UF on a Windows VM, and I'm getting an error that connection to the host failed, with "sock_error = 10054. SSL Error = No error" The indexers I'm trying to connect to can talk to a bunch of other Windows VMs. The ports to the indexers are open from the Windows VM that's having the problem. This configuration worked when I installed it on other VMs What does "SSL Error = No error" mean? ... View more

I know that once an event is indexed, it cannot be modified. But is that specifically stated somewhere in the Documentation? I need to provide proof of it for security documentation. ... View more