Hi all I am having issues trying to script enabling and disabling maintenance mode with a hashed password. The command is /opt/splunk/bin/splunk enable maintenance -mode - auth admin: somepassword Is there a way I can hash the password. I have tried the hash-passwd and user-seed.conf but it does not seem to hash my clear text password upon restarting splunk   ... View more

hi all I am running on a windows heavy forwarder on Splunk Enterprise 8.1.7.2 and I listen to ports tcp 9514 and udp 514. The data comes in to the main index and I perform a transforms/ props to a other index and the logs go into my indexers and search heads (both search head and indexers are redhat 7.9 splunk enteprise 8.2.0) However in my heavy forwarders i send a copy off to another set of splunk redhat 7.9 heavy forwarders but it seems anything besides the default splunk logs on tcp 9997 does not reach them My config is follows   Inputs.conf [tcp:9514] disabled = false connection_host=ip index =main ##inputs.conf [udp:9514] disabled = false connection_host=ip index =main [udp:514] disabled = false connection_host=ip index =main [tcp:514] disabled = false connection_host=ip index =main     ##transforms.conf [index_redirect_to_pci] REGEX = . DEST_KEY = _MetaData:Index FORMAT = pci ### props.conf [host::x.x.x.x] TRANSFORMS-rt1 = host_rename_rt1,index_redirect_to_pci   How do I get the logs for the 514 and 9514 to be forwarded to the second set of heavy forwarders I have one redhat heavy forwarder that I installed syslog-ng on and change splunk to monitor that folder and remove the listen to port 514 and that's the only splunk heavy forwarder that can send syslog data over to the second set of splunk that is not receiving the logs from the transformed index ... View more

hi I have this issue where the db connect installed on a heavy forwarder is not able to forward logs to the indexers in a particular sourcetype configured in the indexer The heavy forwarder obtains the logs from the mssql database using http event collector From splunkd log and metric logs i can see the non db connect logs being forwarded on the standard 9997 port We are able to run the sql query in db connect and able to see results Not quite sure where i should troubleshoot and hoping for some leads The db connect version is 3.1.4 and the splunk enterprise version is 7.2.6 I do not see error 400 on the db connect server or command and audit logs tho ... View more