Please see http://answers.splunk.com/answers/188784/after-update-to-splunk-enterprise-62-why-does-the.html for the answer.
To Summarize: It is a product defect, I believe for the deployment monitor. Cause: In Splunk Enterprise 6.2, indexers are logging new events to metrics.log/group=tcpin_connections to record forwarder connection events, such as a connection closing.
Fix is to change macros.conf in deployment monitor. Details are here
... View more
I would like to see that documentation updated. When I attempt to use Splunks openssl to create a cert the following error occurs:
openssl: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory
This problem was asked in http://answers.splunk.com/answers/32462/creating-new-csr-unable-to-find-shared-library-libsslso098 and there are no answers.
Any help would be appreciated.
... View more