Pretty close. This one worked for me.  | rex field=_raw "statement:(?<statement>[^^$]+)" ... View more

@gn694 is this done for the service account that is running the SQL Server service, or for the service account that db_connect is trying to use to connect to MS SQL?   I'll paste this here as well for reference: Register a Service Principal Name for Kerberos Connections - SQL Server | Microsoft Learn   ... View more

This is no longer the case. See https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf # The following settings work identically as for [monitor::] stanzas, # documented previously host_regex = <regular expression> host_segment = <integer> crcSalt = <string> recursive = <boolean> whitelist = <regular expression> blacklist = <regular expression> initCrcLength = <integer> time_before_close = <integer> ... View more

I know this is an old thread, but the only one I found that had the same error and my fix is different. Please give me a thumbs up if it helps you: I'm running DB Connect 3.9.0 and Splunk DBX Add-on for Microsoft SQL Server JDBC installed on a Heavy Forwarder.  The error I got during validation of the new connection was: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target". ClientConnectionId: xxxxxxxxxxxx" In order to fix this, I had to Enable SSL. This will enable another field called 'Certificate'. What needs to be pasted here is the public key of the host you are trying to connect to. You will need to open up the name_of_public_key_of_dbhost.pem, copy the contents and paste it in "Certificate". Now click save.    ... View more

That is correct. To make it easier for you to know what has been concatenated together without having to use openssl or open each one to compare in the future - you can place all the individual root CA's in the same folder as well - for reference only: and only point to that one .pem file in server.conf : Hope that helps.  ... View more

web.conf if for Splunk Web. In order to use this, your private key must be decrypted. Which means, you are able to verify the certificate using ssl and it doesn't prompt you for a password. But I doubt you need to access your indexer in Splunk Web. When I changed our certificates system-wide these were my notes for Indexers: ---To prevent server from trying to reach Splunk Base for updates-- Etc/system/local/server.conf  [applicationsManagement]  allowInternetAccess = false   ---without this, mongod will fail to start.  [kvstore] serverCert = $SPLUNK_HOME/etc/auth/<servername>/<servername>.pem  sslPassword = <password_of_serverCert>    [sslConfig]  serverCert = $SPLUNK_HOME/etc/auth/<servername>/<servername>_.pem  sslPassword = <password_of_serverCert>  sslRootCAPath = $SPLUNK_HOME/etc/auth/rootca/Root_CA.pem   Etc/system/local/inputs.conf    [SSL]  serverCert = $SPLUNK_HOME/etc/auth/receiver/receiver_cert.pem  sslPassword = <password > sslVersions = -all, tls1.2   Now, if you must access Splunk Web into the indexer: Etc/system/local/web.conf  Note: Splunk Web will not work with encrypted private key. Ensure you are using  decrypted private key and certificate for this configuration.    [settings]  privKeyPath = $SPLUNK_HOME/etc/auth/<servername>/<webServerCert>_webServerCert_priv.key  serverCert = $SPLUNK_HOME/etc/auth/<servername>/< webServerCert>_webServerCert_cert.pem    To export private key decrypted for us in Splunk Web web.conf, you can use the following: Export private key, you will need the pass phrase: openssl rsa -in server_priv.key -out web_server_priv.key you can copy this contents and replace the key on your original servercert.pem and save it as whatever name you like: web_servercert.pem Test your certificate to ensure you are not prompted for passphrase:  openssl rsa -in web_servercert.pem –text (Remember, you will only use this for web.conf, if you try to use this in server.conf - mongod will not start due to no passphrase)   ... View more

Go to: etc/system/local/server.conf [sslConfig] serverCert = $SPLUNK_HOME/etc/auth/server.pem If you are seeing server.pem, or this entry is missing (which means you are using default) what that error means is that you are using a self signed certificate, which is a vulnerability. You will need to purchase third party SSL certificates and implement it to your system.  There's more information here: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Howtogetthird-partycertificates ... View more

Correction: Copy from -----BEGIN CERTIFICATE-----, all the way to -----END CERTIFICATE----- ... View more

Great tip DalJeanis ... View more

"The one caveat is that the field you want to specify must be returned in the first result row of the search. So, if your search returns the field host, you should just be able to plug it in as stated above."   This helped me tons! I've been trying to resolve my issue. I have an alert, that needs to display results even when there are no results. So I added this and it worked great: | appendpipe [stats count as _resultcount ] However,  I needed to display this count in the subject line of the email. When there were 0 results, it worked fine, but when there were actual results - it didn't work! I couldn't use $job.resultCount$ because I had an extra row, so it was not accurate. It was so puzzling, and ran into your answer. I added this, and now it works: | sort _resultcount Thank you!!! ... View more

@to4kawa thank you so much again!! You rock! Both worked, I just went with this one because it's simpler. Or looked to be, let me know if the other one is more efficient. But they both worked well! One day I wanna be like you 🙂 ... View more

This worked beautiful!! lol. I tested various numbers, and all tested consistent. Thank you so much @to4kawa  ... View more

This worked for me as well. However, I would like to add there are 2 other places to ensure that your instance name matches the hostname - which is commonly related to this issue as well.  in $SPLUNK_HOME/etc/system/local/inputs.conf   check host=setting that may be the old hostname    in $SPLUNK_HOME/etc/system/local/server.conf    check servername= setting that may have the old hostname Give me a thumbs up if you found this helpful 🙂 ... View more

@SplunkHead10 it might be a better idea to revert your changes from the default folder, and apply it to the local folder instead. If you have to update or restore default, your local settings will not be affected. I could be wrong, I'm still fairly new.  ... View more

Hi @nickhills , I would like to see the different count of time ranges in it's own column by sitename.  First column sitename, 2nd column count of the past 24 hours, 3rd column count of the past 30 days, 4th column count of the past 60 days, and 5th column count of the past 90 days. Thanks for your suggestion, I tried playing around with it - but I couldn't get the results I'm looking for. Let me know if you have another suggestion, I truly appreciate it.  ... View more