Hi, I have a CloudTrail data source feeding into the AWS Add-On app on a single-instance Splunk deployment. If I go to the AWS app and do a search from within that app, Splunk is able to extract all the interesting fields and populate them into key-vaule pairs just fine. However, I've built a dashboard using that data source and interesting fields in the S&R app and Splunk does not populate those same key-vaule pairs as it would in the AWS app. The only way to extract those key-vaule pairs from within the S&R app is to do a 'spath' search which is not the best way to build the searches in the dashboard. I've already checked the fields settings and it's showing all the AWS fields enabled globally in the permissions section. Has anybody experienced this issue before, or have any ideas where to poke at to get the fields to be extracted globally? ... View more

I'm tasked with moving the $SPLUNK_HOME/etc/system/local/ conf files within our peer nodes to their own Splunk apps for easier management using the deployment-server/cluster master method. Since, we are using third-party SSL certificates to secure log ingestion from the forwarders each peer has their own unique .pem file. What is the best way to incorporate the inputs.conf file regarding the SSL configs, for all peer nodes within a Splunk app that will be distributed to all peers? Specifically, I'm referring to the serverCert option, which has a different filename on each peer node. All other config options are the same within the inputs.conf files. Thanks! ... View more

I've been trying for a few days now to setup a HEC on a Splunk Heavy Forwarder and having issues with the splunkd process binding to the default tcp/8088 port. I can see this error within the splunkd.log FATAL HTTPServer - Could not bind to port 8088 However, I can verify that my localhost is listening on the port netstat -tulpn | grep 8088 tcp 129 0 0.0.0.0:8088 0.0.0.0:* LISTEN 13924/splunkd Also you can notice the queue filling up on that port I've configured the Splunk HEC global settings on the Splunk Web UI already and enabled the http input in the inputs.conf file already. I've configured to accept connections over SSL and enabled those settings also within the inputs.conf file as well [http] enableSSL = 1 #requireClientCert = false #privKeyPath = /opt/splunk/etc/auth/splunk-certs/splunkforwarder.key serverCert = /opt/splunk/etc/auth/splunk-certs/splunkforwarder.pem #rootCA = /opt/splunk/etc/auth/splunk-certs/ca-chain.pem Any help would be greatly appreciated! ... View more