I am trying to enable a connection from the Splunk DB Connect app to a MariaDB (MySQL) database in AWS, which requires SSL and a particular pem file to connect. I cannot find any specific documentation or examples on Answers on how to accomplish this. Can someone point me in the right direction? I am using the MySQL 5.1 JDBC driver, if that matters - which supports SSL. ... View more

I have been researching the docs here: https://docs.splunk.com/Documentation/Splunk/6.6.3/Security/Rolesandcapabilities There isn't a good mapping of what I am trying to accomplish here in the docs. We are trying to automate some routine maintenance and also enable our hardware teams to replace disks as they fail without requiring scheduling with our team - outside of approvals and verifications. Can someone assist me in identifying the minimum capabilities needed for this service account I have created (LDAP) to be able to perform the following: Enable Maintenance Mode Disable Maintenance Mode Rebalance Primaries Rebalance _raw data Splunk offline I have not listed splunk stop/start because those commands do not require authentication from the CLI. ... View more

I am working with a heavy forwarder tier that is running syslog where network devices are sending data. For ease of tracking where each file is being monitored from, I would like to add some metadata to the monitored files, that includes the heavy forwarder they are being collected from (this tier is load balanced so the data could land on any number of hosts). I have tried adding _meta = heavy_forwarder::$HOSTNAME and that does not appear to be doing the trick - It actually just puts $HOSTNAME as the value. Example monitoring stanza: [monitor:///var/log/remote/my_network_device] index = network sourcetype = mysourcetype ignoreOlderThan = 1d disabled = false host_segment = 4 blacklist = \.(gz|tgz|xz|\d{1})$ _meta = heavy_forwarder::$HOSTNAME I have also tried to add _meta = heavy_forwarder::$HOSTNAME to the [default] stanza and it has the same results. I know I can hardcode the hostname in system/local/inputs.com - I just am trying to think of a much less manual solution to handle dynamic scaling of the HF tier. Any help would be greatly appreciated. ... View more