Hi @nachimistry  find below, it seems set at runtime :   ps -ef | grep persistconn/appserver.py splunk.+ 44704 46833 2 17:48 ? 00:00:00 /OPT/splunk/bin/python3.9 /OPT/splunk/lib/python3.9/site-packages/splunk/persistconn/appserver.py splunk.+ 44993 42325 0 17:49 pts/0 00:00:00 grep --color persistconn/appserver.py tr '\0' '\n' < /proc/44704/environ | grep -i ssl SSL_VERIFY=/OPT/splunk/etc/auth/certmonger/ca.crt OPENSSL_CONF=/OPT/splunk/openssl/openssl.cnf SSL_CERT_FILE=/OPT/splunk/openssl/cert.pem /OPT/splunk/bin/splunk envvars PATH=/OPT/splunk/bin:/USR/oursplunkuser/.local/bin:/USR/oursplunkuser/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin ; export PATH ; SPLUNK_HOME=/OPT/splunk ; export SPLUNK_HOME ; SPLUNK_DB=/OPT/splunk/var/lib/splunk ; export SPLUNK_DB ; SPLUNK_ETC=/OPT/splunk/etc ; export SPLUNK_ETC ; SPLUNK_SERVER_NAME=Splunkd ; export SPLUNK_SERVER_NAME ; PYTHONHTTPSVERIFY=0 ; export PYTHONHTTPSVERIFY ; SPLUNK_OS_USER=oursplunkuser ; export SPLUNK_OS_USER ; PYTHONUTF8=1 ; export PYTHONUTF8 ; SSL_VERIFY=/OPT/splunk/etc/auth/certmonger/ca.crt ; export SSL_VERIFY ; PYTHONHASHSEED=random ; export PYTHONHASHSEED ; NODE_PATH=/OPT/splunk/lib/node_modules ; export NODE_PATH ; LD_LIBRARY_PATH=/OPT/splunk/lib ; export LD_LIBRARY_PATH ; OPENSSL_CONF=/OPT/splunk/openssl/openssl.cnf ; export OPENSSL_CONF ; SSL_CERT_FILE=/OPT/splunk/openssl/cert.pem ; export SSL_CERT_FILE ; TZ=:/etc/localtime ; export TZ ; LDAPCONF=/OPT/splunk/etc/openldap/ldap.conf ; export LDAPCONF   Thanks again. ... View more

Hi @nachimistry  kept only SSL_VERIFY=/OPT/splunk/etc/auth/ourownpki/ca.crt and it works! It includes intermediate and root CA. Does this only impact litellm connection? FYI still getting WARN about /OPT/splunk/openssl/cert.pem, couldn't find any .conf mentionning it with grep. Thanks again for your help. ... View more

Hi @nachimistry thank you very much it works finally 🤗 but with SSL_VERIFY=False    /OPT/splunk/bin/splunk cmd python3 -c "import ssl,certifi,urllib.request; ctx=ssl.create_default_context(cafile=certifi.where()); print(urllib.request.urlopen('https://ouraiurl/v1/models', context=ctx).status)" Traceback (most recent call last): File "/OPT/splunk/lib/python3.9/urllib/request.py", line 1346, in do_open h.request(req.get_method(), req.selector, req.data, headers, File "/OPT/splunk/lib/python3.9/http/client.py", line 1285, in request self._send_request(method, url, body, headers, encode_chunked) File "/OPT/splunk/lib/python3.9/http/client.py", line 1331, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/OPT/splunk/lib/python3.9/http/client.py", line 1280, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/OPT/splunk/lib/python3.9/http/client.py", line 1040, in _send_output self.send(msg) File "/OPT/splunk/lib/python3.9/http/client.py", line 980, in send self.connect() File "/OPT/splunk/lib/python3.9/http/client.py", line 1454, in connect self.sock = self._context.wrap_socket(self.sock, File "/OPT/splunk/lib/python3.9/ssl.py", line 506, in wrap_socket return self.sslsocket_class._create( File "/OPT/splunk/lib/python3.9/ssl.py", line 1049, in _create self.do_handshake() File "/OPT/splunk/lib/python3.9/ssl.py", line 1318, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1143)   I tried adding on my test search head (in distributed environment) in splunk-launch.conf :  SSL_CERT_FILE=/OPT/splunk/etc/auth/ourownpki/ca.crt : KO (same CA as litellm URL and search head) Please note I can see this in splunkd.log : 10-28-2026 11:31:10.675 +0100 ERROR PersistentScript [12893 PersistentScriptIo] - From {/OPT/splunk/bin/python3.9 /OPT/splunk/lib/python3.9/site-packages/splunk/persistconn/appserver.py}: WARNING Environment variable SSL_CERT_FILE is set to a non-existent path: /OPT/splunk/openssl/cert.pem. Removing it to prevent SSL errors. /OPT/splunk/openssl/cert.pem doesn't even exist.   Thanks again for your help.   ... View more

Hello @nachimistry thanks for your answers. - Tried $SPLUNK_HOME/bin/splunk cmd python3 -c "import urllib.request; req = urllib.request.Request('https://<gateway>/v1/models', headers={'Authorization': 'Bearer TOKEN}); print(urllib.request.urlopen(req).status)" : getting : 200 so looks good? - It doesn't go through proxy, I tested another AI app and it works fine however I had to disable "Verify TLS certificate" - I tried all possible paths including /v1, /v1/chat/completions... - It says "ERROR PersistentScript [53396 PersistentScriptIo] - From {/OPT/splunk/bin/python3.9 /OPT/splunk/lib/python3.9/site-packages/splunk/persistconn/appserver.py}: Connection test failed for connection='op_qwen38_27b', provider='Custom', model='op-qwen3.8-27b': LiteLLM connection failed: litellm.InternalServerError: InternalServerError: OpenAIException - Connection error."   Thanks for your help.   ... View more

Thanks @PickleRick what about splunk-launch.conf? ... View more

Hi @amara at https://splunkbase.splunk.com/app/3661 not this one https://splunkbase.splunk.com/app/9687 which looks up to date. ... View more

Hi @outcoldman  it says "open file" instead of "finished reading" ... View more

Hi @PickleRick I can see this source in both command outputs. ... View more

Hi @gcusello yes of course through outputs.conf, thanks. ... View more

Hello @Latefa you can check this doc https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.3/threat-intelligence/add-new-threat-intelligence-sources-in-splunk-enterprise-security#f6602b55_45ca_40de_a673_3f4ef9aadb46--en__Add_a_URL-based_intelligence_source ... View more

Hello @Praz_123 you can run these queries from the license manager : index=_* source=*license* | eval mb=round((b/1024),2) | stats sum(mb) as totalkb by h | sort - totalkb | eval totalkb=round(totalkb/1024) | rename totalkb as totalmb You can have also nice chart over days with this: index=_internal source=*license_usage.log type=Usage earliest=-0d@d latest=now | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="today" | streamstats sum(Total_MB) as cumul | append [search index=_internal source=*license_usage.log type=Usage earliest=-1d@d latest=-0d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="yesterday" | streamstats sum(Total_MB) as cumul| eval _time=_time+86400 ] | append [search index=_internal source=*license_usage.log type=Usage earliest=-2d@d latest=-1d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="2 days ago" | streamstats sum(Total_MB) as cumul| eval _time=_time+172800] | append [search index=_internal source=*license_usage.log type=Usage earliest=-3d@d latest=-2d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="3 days ago" | streamstats sum(Total_MB) as cumul| eval _time=_time+259200] | timechart span=15m avg(cumul) by ReportKey ... View more

Hello @LESMeeks where did you deploy it? There is no need to open configuration page, just put it on HF and SH.  ... View more

Hello @hilal thank you very much! ... View more