Hello, for this question, I am referencing the documentation page: https://docs.splunk.com/Documentation/SOARonprem/6.2.2/Install/UpgradePathForUnprivilegedInstalls There are two sets of conflicting information, and I do not know how to proceed with my ON PREMISE, UNPRIVILEGED, PRIMARY + WARM STANDBY CONFIGURATION (database is on the instances, not external): At the top of the documentation, it states: Unprivileged Splunk SOAR (On-premises) running a release earlier than release 6.2.1 can be upgraded to Splunk SOAR (On-premises) release 6.2.1, and then to release 6.2.2. It says CAN BE. So.... is it optional? All deployments must upgrade to Splunk SOAR (On-premises) 6.2.1 before upgrading to higher releases in order to upgrade the PostgreSQL database. It says MUST UPGRADE. So.... is it mandatory? But then, towards the BOTTOM of the table, I'm looking at the row beginning with the entry stating that I am starting with version "6.2.0" Steps 1 & 2 are conditionals for clustered and external PostGreSQL databases. Step 3 goes directly to upgrading to 6.2.2. So..... Do I, or do I NOT, upgrade to 6.2.1 first?  ... View more

I guess the question can be broad, but I am coming from the following scenario: I am using the Splunk app, which has been configured and connection tested successfully in SOAR.  Recently, something happened that I did not expect - the credentials to Splunk were rejected and the action to "run query" returned with an expected message of: "Unauthorized Access (401)". But then the action terminated there and did not continue with the rest of the playbook.  I have another app action for Ansible Tower to run a (Ansible) playbook (action name is "run job"), and if the Ansible playbook fails, the action in Splunk SOAR is marked as FAILED, but the SOAR playbook continues otherwise. I can't tell what the difference is between these two actions that allows one to continue, but the other to halt the SOAR playbook progression. Any advice is appreciated. 🙂  ... View more

Good morning! Is there a way to update the display message on the Warm Standby instance when users navigate to it? ... View more

As the title suggests, our system needs a proxy to hit our SAML2 authentication service, but I don't see an option to provide a proxy, or to provide an attribute to describe a proxy like we can do in the apps. Can someone please suggest documentation? 🙂 Thank you! ... View more

As the title suggests, I got some SSL certs from my teams, but because the default SSL port is 8443, it's not recognizing the certificates.  I'm kind of a noob to certificates, though, so I hope I'm explaining it right.  ... View more

Our current SOAR servers, fresh install on AWS EC2s, 500's each night. Upon investigation, it looks like there's this error in the logs: File "/opt/soar/usr/python39/lib/python3.9/site-packages/psycopg2/__init__.py", line 127, in connect conn = _connect(dsn, connection_factory=connection_factory, **kwasync) django.db.utils.OperationalError: connection to server on socket "/tmp//.s.PGSQL.6432" failed: No such file or directory Is the server running locally and accepting connections on that socket? On a healthy server, that file is present. On a 500-error server, it's missing. Is there an explanation of why that might be going missing? Issue is temporarily resolved by stopping and starting phantom again.  I think it might be related to PostgreSQL or pgbouncer.  ... View more

I have a Splunk Connect instance on my OpenShift cluster that's currently sending all logs to a logging index. There's no special configuration and the only tweeking done after installation is pointing to the right Splunk instance / applying the HEC token value.  Is there a way to set the config map such that all logs from a namespace (i.e. 'specificApplication') goes to an index? Here's a snippet of what the current config map for logging looks like - not sure if this would shed insight as I'm not too familiar with Splunk:       <match **>         @type splunk_hec         protocol http         hec_host "xx.x.xx.xx"         hec_port 8088         hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"         index_key index         #insecure_ssl true         host "#{ENV['K8S_NODE_NAME']}"         source_key source         sourcetype_key sourcetype ... View more