I just noticed that our Redhat splunk servers are missing audit log data for users logging in to Splunk. For example, this query no longer returns data: index=_audit action="login attempt" "info=succeeded" I do have some audit data, just not the login attempts. The data seems to of stopped after upgrading to version >=8.0.0 I only have one windows splunk server, and ALL the audit data appears to be there. ... View more

Can anyone tell me where the "Destination app" can be set for a SourceType? When we try to change it in the GUI, we get a red circled restriction icon. ... View more

I am trying to generate a new cert for my kv store to work properly (I am having this problem - https:// answers.splunk.com/answers/397029/kv-store-lookup-failing-with-error-about-kv-store.html) But when I attempt to generate a new cert it just returns the output below. Is there a log or something I can change to figure out what I am doing wrong? C:\Program Files\Splunk\bin>.\splunk createssl server-cert -l 1024 -d "C:\Program Files\Splunk\etc\auth\" -n server.pem -c {IP Address} Parameters: -d: Directory where rootCa and other certs are stored. (required) -n: The name of the cert. (required) -c: The CommonName for the cert. This should match the DNS name. If DNS is not available then the IP will suffice. -l: Length of the RSA key to generate (default 1024). -p: Prompt for optional arguments. Server 2012 running dev license splunk version 7.2.5 ... View more