Hi, I've got an issue where I need to display multiple years for the Calendar Heat Map however it appears to have a limit of 12 months. That is fine I can just have a panel for each year with this search index=`my_index` sourcetype=bluecoat_importer_queue_status section=queue_status subsection=dump | dedup filename | eval _time = date_timestamp | eval start_of_year = strptime("2017-01-01","%Y-%m-%d") | eval end_of_year = strptime("2018-01-01","%Y-%m-%d") | where _time > start_of_year AND _time < end_of_year | eval status = case (queue=="splunk_completed",100,queue_status=="pending",50,queue_status=="in_progress",50,queue_status=="processing",50,1==1,0) | table _time filename queue queue_status status | timechart span=1d max(status) as status | search status=* Note how status gets set to 0, 50 or 100. Where I plan to have 0 = red 50 = orange or brown 100 = green Problem is the 2017 year doesn't have any results that contain 100 so the auto colour pickers picks a different set of colours. Note green for 2017 should be brown. Is there any way for me to hardcode these colour ranges or values so I can keep consistency between years? ... View more

Further to my question the other day about decoding a binary file I finally got it working in Linux!!! https://answers.splunk.com/answers/548714/unarchive-cmd-for-decoding-binary-file-with-python.html Problem is when I installed it on Windows it fell in a massive heap. The decoding script still works when I run it manually from a Windows command prompt. type C:\Splunk\Log_Spool\20170717.evl | C:\Python27\python.exe C:\Temp\TA-customer\bin\decode_evl.py > C:\Splunk\Log_Spool\20170717.evl.decoded However no matter what combination I put into props.conf it just wont run. Splunk just hoovers up the binary file as is and doesn't even give a warning or error that unarchive_cmd might be wrong. inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-customer\spool\*.evl] disabled = 0 index = customer sourcetype = customer:evl followTail = 0 props.conf ################################################### [source::C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-customer\spool\*.evl] NO_BINARY_CHECK = true invalid_cause = archive # This works perfectly in Linux # unarchive_cmd = /opt/splunk/etc/apps/TA-customer/bin/decode_evl.py # None of these work in Windows # unarchive_cmd = C:\Progra~1\SplunkUniversalForwarder\etc\apps\TA-customer\bin\decode_evl.py # unarchive_cmd = C:\System\Python27\python.exe C:\Progra~1\SplunkUniversalForwarder\etc\apps\TA-customer\bin\decode_evl.py # unarchive_cmd = C:\\System\\Python27\\python.exe C:\Progra~1\\SplunkUniversalForwarder\\etc\\apps\\TA-customer\\bin\\decode_evl.py unarchive_cmd = C:\System\Python27\python.exe C:\Progra~1\\SplunkUniversalForwarder\\etc\\apps\\TA-customer\\bin\\decode_evl.py # unarchive_sourcetype = customer:evl:decoded # priority = 10 Any help would be appreciated. This is driving me up the wall!!! ... View more

So I have been trying to get a solution where you do not need to have an SSL certificate on a universal forwarder for sending data base to Splunk on port 9997. However I can't seem to get it to work. https://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Inputsconf and https://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Outputsconf This from the inputs.conf seems to indicate by default you do not need to have a SSL certificate on the forwarder at all requireClientCert = <bool> * Determines whether a client must present an SSL certificate to authenticate. * Full path to the root CA (Certificate Authority) certificate store. * The <path> must refer to a PEM format file containing one or more root CA certificates concatenated together. * Defaults to false. My working conf with SSL certs on both ends. inputs.conf ############################### # Encrypted receiver ############################### # Ref : http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate # Ref : http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousesignedcertificates [splunktcp-ssl:9997] disabled = 0 # requireClientCert = false ############# # IMPORTANT: If this configuration is placed within an local/inputs.conf in an app the password will not be encrypted. # If you require encryption the inputs.conf definitions must be in $SPLUNK_HOME/system/local/inputs.conf [SSL] serverCert = $SPLUNK_HOME/etc/apps/cfgd_ssl_certs_servers/auth/myFullIndexerMediaCertificate.pem sslPassword = ************* outputs.conf # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf [tcpout] defaultGroup = indexers indexAndForward = false [tcpout:indexers] server = 192.168.55.55:9997 # IMPORTANT: Ensure indexer is also configured http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate a configuration app is also available for that. sslCertPath = $SPLUNK_HOME/etc/apps/cfgd_fwd_to_idx_ssl/auth/myFullForwarderCertificate.pem sslPassword = ******* sslVerifyServerCert = false # sslCommonNameToCheck = indexer.mydomain.com # While compression should not add too much overhead if there are performance issues this could be disabled to see if this alieviates the problem. useClientSSLCompression = true Now trying this next configuration does not work. If I try to use the requireClientCert set to false (even though it defaults to false) I never see any data from the forwarder. inputs.conf ############################### # Encrypted receiver ############################### # Ref : http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate # Ref : http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousesignedcertificates [splunktcp-ssl:9997] disabled = 0 requireClientCert = false ############# # IMPORTANT: If this configuration is placed within an local/inputs.conf in an app the password will not be encrypted. # If you require encryption the inputs.conf definitions must be in $SPLUNK_HOME/system/local/inputs.conf [SSL] serverCert = $SPLUNK_HOME/etc/apps/cfgd_ssl_certs_servers/auth/myFullIndexerMediaCertificate.pem sslPassword = *********** outputs.conf # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf [tcpout] defaultGroup = indexers indexAndForward = false [tcpout:indexers] server = 192.168.55.55:9997 # IMPORTANT: Ensure indexer is also configured http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate a configuration app is also available for that. sslVerifyServerCert = false # sslCommonNameToCheck = indexer.mydomain.com # While compression should not add too much overhead if there are performance issues this could be disabled to see if this alieviates the problem. useClientSSLCompression = true So the takeaway here is what does the requireClientCert do if it doesn't work when a forwarder contacts the server without a certificate? ... View more

I was hoping to get some clarification on this as there is no specific information that I could find in the documentation. We obviously have these main ports in use for most Splunk installations. Port 8000 - Splunk Web interface Port 8089 - Splunk internal comms Port 9997 - Splunk receiving Would this graphic I put together accurately describe which .conf configurations affect each of the above? I know there used to be some overlap with the some of the SSL configurations in server.conf which impact port 8000 but in recent Splunk releases it appears to have been separated out and compartmentalised to be contained in web.conf Is there something missing from my diagram? Are there any server.conf settings still affect the Splunk web on 8000 at all? Thanks ... View more