Will the Splunk VMWare TA's run with Splunk running in FIPS mode? ... View more

DB Connect 3.14, Splunk Enterprise 7.3. Trying to connect to an SCCM MSSQL instance. Cannot seem to make it past Kerberos authentication. kinit retrieves the certificate just fine, verified using klist. Configured DB Connect using same parameters (and several others) and it times out when trying to save the config (It sends three connection attempts before failing). Captured the traffic from the two sessions (kinit and DB Connect). They packet captures are similar, but not identical. Obvious differences are: ticket_lifetime, renew_lifetime, and encryption types. The first two are not showing up in the DB Connect packet capture (shows 1970 (defaulting to epoch?)). The third item is encryption types, kinit presents 8 types, DB Connect presents only 4. It is as if DB Connect is not reading the file /etc/krb5.conf. Validated that "splunk" can read the file. I suspect the three settings above since I can see DB Connect sending three connection attempts with no response from the Kerberos server, where kinit gets an immediate response. Am I going to far and missing something? ... View more

Installed Alert Manager on stand-alone Splunk server for testing without any problems. Great app. Replicated the installation process to a single SH and clustered indexers. Created the alerts index on SH and Indexers. Cannot seem to make it work. The only error found is the following (repeating every second). Any help in getting this running would be appreciated. MongoModificationsTracker - Could not load configuration for collection 'drilldown_settings' in application 'alert_manager'. Collection will be ignored. ... View more

I have been tasked with deploying Splunk for an organization that has an extensive syslog (multiple rsyslog & syslog-ng svrs) environment. The problem is with their naming convention. Of the hundreds of syslog sources, only 60% follow a naming convention. The remainder may be (random) IP's, or a hostname that does not align with its events. The logs are not stored in logical directories, AND..... they are unwilling to make the changes necessary to "clean it up". The REGEX's in inputs.conf if rapidly becoming ugly, and with every change, requires complete re-validation. What do others do in this situation to manage poor syslog naming conventions, and still get the events into the proper indexes without the extensive use of REGEX in inputs.conf, and without touching the syslog conf? ... View more