About mpavlas

mpavlas · ‎01-29-2026

Just to be clear - this is about Universal Forwarder, not the Heavy one. The Launch Date of 6405U was Q4'19. It's not ancient. We would have bought the i3 if we had known this would happen. We have to maintain security updates to pass authorized Nessus scans and it's not long time ago when there was PostgreSQL binary with known issues even in splunkforwarder package. It's just better to keep all things up to date for us.

mpavlas · ‎01-29-2026

Hi, we are upgrading our Splunk to version 10.2 and one of Forwarders refused to update because of: * Active KVStore version upgrade precheck PASSED * CPU Info upgrade precheck FAILED! -- This check is to ensure that Splunk is running on supported CPU with required microarchitecture and instruction sets enabled. -- CPU Details: CPU Vendor: GenuineIntel CPU Brand: \x Missing Requirements: - CPU missing required AVX instruction set for Intel processors In order to fix this failed check follow the 'System requirements for use of Splunk Enterprise on-premises' documentation: https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements If you are absolutely certain that your system meets the requirements, try setting the SPLUNK_SKIP_PREINSTALL_CPU_CHECKS_CORRUPTING_DATA_IF_UNSUPPORTED environment variable to 1. It's Intel(R) Pentium(R) CPU 6405U so it doesn't have the AVX instructions. I'm not sure if KVStore is actually used by Splunk Forwarder at all. Can somebody confirm or deny if I can use the SPLUNK_SKIP_PREINSTALL_CPU_CHECKS_CORRUPTING_DATA_IF_UNSUPPORTED variable?

mpavlas · ‎09-22-2025

Hi, https://splunkbase.splunk.com/app/3013 states the Latest Version 4.0.5 is compatible up to Splunk Enterprise, Splunk Cloud Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 Will it run with Splunk 10.0?

mpavlas · ‎09-22-2025

Hi, https://splunkbase.splunk.com/app/2878 states the Latest Version 2.3.2 is compatible up to Splunk Enterprise, Splunk Cloud Platform Version: 9.4, 9.3 Will it run with Splunk 10.0?

mpavlas · ‎11-16-2022

Hi, after upgrade to Splunk 9.0.2 the UFMA started to use https://[::1]:8089/services/deployment/server/clients?count=0 for REST API call which resulted into 400 Host header contains invalid characters. I was able to 'fix' this by adding connectUsingIpVersion = 4-first to [general] section in server.conf. What would be the correct way?

mpavlas · ‎12-13-2021

Sorry, you need sudo setcap 'cap_net_bind_service=+ep' /opt/splunk/bin/splunk as well

mpavlas · ‎12-13-2021

More secure way: sudo setcap 'cap_net_bind_service=+ep' /opt/splunk/bin/splunkd echo /opt/splunk/lib | sudo tee /etc/ld.so.conf.d/splunk.conf sudo ldconfig Then you can run Splunk as non-root user on port 443.

mpavlas · ‎01-07-2016

https://answers.splunk.com/answers/222947/does-splunk-ldap-support-starttls.html

mpavlas · ‎03-17-2015

According to Tenable we will have to disable LDAPS soon. Is it possible to use STARTTLS on LDAP port in Splunk instead?

mpavlas · ‎04-09-2014

Splunk 6.0.2 is linked against OpenSSL 1.0.1e which has serious security flaw (CVE-2014-0160). When will be Splunk with fixed OpenSSL (1.0.1g) available?

mpavlas · ‎10-15-2012

I got report from Nessus saying Splunk is vulnerable to CVE-2011-1473 - renegotiation DoS over SSLv3. How can I fix this?

Posts	11
Solutions	0
Karma Given	0
Karma Received	7
Member Since	‎08-15-2011

Online Status	Offline
Date Last Visited	‎01-30-2026 07:17 AM

Does Splunk Forwarder 10.2 really require AVX?

PagerDuty App for Splunk app compatibility

Slack Notification Alert app compatibility

After upgrade we are receiving this error UFMA - [...

Does Splunk LDAP support STARTTLS?

OpenSSL security bug

Splunk SSL renegotiation

Re: Does Splunk Forwarder 10.2 really require AVX?