The correct workaround should have been [tcpout]
negotiateProtocolLevel = 5 negotiateProtocolLevel = 0 is no longer valid (see enableOldS2SProtocol in 9.1.x outputs.conf) with 9.1.x and is likely to cause issues.
... View more
I encounter this as well when running splunkforwarder on kubernetes cluster as daemonset. This was solved by mounting the volume to /opt/splunkforwarder-etc/ instead of /opt/splunkforwarder. It seems that all the local/custom configuration should be implemented on /opt/splunkforwarder-etc/
... View more
KV_MODE = json
your question is corrected and spath works fine, basically this setting is work.
If you modify conf, you must restart splunk.
... View more
Even admin and other privileged users can have a lock out policy. There is a capability inside roles management named "never_lockout". You just have to removed it under the "admin" default role.
... View more