Hi IMHO: even it said in docs that you must use sudo when you use "splunk start/stop/restart" it don't say that you should use that instead of use "systemctl  start/stop/restart Splunkd"! This should said more clearly here. Definitely docs feedback is needed. After you have configured systemd into use you should use only it not directly splunk start/stop/restart. Only what you are needed is "splunk offline" when you are stopping one node on indexer cluster. All other action should use "systemctl start/stop/restart Splunkd"! r. Ismo Doc feedback has left. ... View more

Brilliant! Used this twice now and it worked each time, with the 2nd host I had to remove the UpgradeCodes entry as well. ... View more

TLDR: I was missing 1. outputs.conf on the sender (client) useSSL = true Thank you to michael_bates_1 , in thread https://community.splunk.com/t5/Getting-Data-In/Why-am-I-having-trouble-with-TLS/m-p/634513/highlight/false#M108573 After following the documentation on how to enable ssl between forwarders and indexers, i got the error   ERROR TcpInputProc - Error encountered for connection from src=10.1.1.34:50772. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol   In the documentation: https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/ConfigureSplunkforwardingtousesignedcertificates#Configuration_file_examples_for_configuring_TLS_certificates_on_receiving_indexers , it specifies [SSL] requireClientCert = true Which if you drop, will affect your outputs.conf -> useSSL. It says if requireClientCert is defined, then useSSL will be true. In my case, I mindlessly thought you could set requrieClientCert=false... https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf #----Secure Sockets Layer (SSL) Settings---- # To set up SSL on the forwarder, set the following setting/value pairs. # If you want to use SSL for authentication, add a stanza for each receiver # that must be certified. useSSL = <true|false|legacy> * Whether or not the forwarder uses SSL to connect to the receiver, or relies on the 'clientCert' setting to be active for SSL connections. * You do not need to set 'clientCert' if 'requireClientCert' is set to "false" on the receiver. * A value of "true" means the forwarder uses SSL to connect to the receiver. * A value of "false" means the forwarder does not use SSL to connect to the receiver. * The special value "legacy" means the forwarder uses the 'clientCert' property to determine whether or not to use SSL to connect. * Default: legacy   ... View more

TLDR: I was missing 1. outputs.conf on the sender (client) useSSL = true After following the documentation on how to enable ssl between forwarders and indexers, i got the error   ERROR TcpInputProc - Error encountered for connection from src=10.1.1.34:50772. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol   In the documentation: https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/ConfigureSplunkforwardingtousesignedcertificates#Configuration_file_examples_for_configuring_TLS_certificates_on_receiving_indexers , it specifies [SSL] requireClientCert = true Which if you drop, will affect your outputs.conf -> useSSL. It says if requireClientCert is defined, then useSSL will be true. In my case, I mindlessly thought you could set requrieClientCert=false... https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf #----Secure Sockets Layer (SSL) Settings---- # To set up SSL on the forwarder, set the following setting/value pairs. # If you want to use SSL for authentication, add a stanza for each receiver # that must be certified. useSSL = <true|false|legacy> * Whether or not the forwarder uses SSL to connect to the receiver, or relies on the 'clientCert' setting to be active for SSL connections. * You do not need to set 'clientCert' if 'requireClientCert' is set to "false" on the receiver. * A value of "true" means the forwarder uses SSL to connect to the receiver. * A value of "false" means the forwarder does not use SSL to connect to the receiver. * The special value "legacy" means the forwarder uses the 'clientCert' property to determine whether or not to use SSL to connect. * Default: legacy   ... View more

Hey! I had the same issue. If you look in   index=_internal log_level IN ("error", "warn") splunk_app_addon-builder   You'll find   /opt/splunk/etc/apps/splunk_app_addon-builder/appserver/controllers/app_validation.py cannot be executed by Python: cannot import name 'soft_unicode' from 'markupsafe' (/opt/splunk/lib/python3.7/site-packages/markupsafe/__init__.py)     Seems the python package markupsafe removed 'soft_unicode' , starting from versions later than 2.0.0. Solution is to use pip to downgrade   pip3 install --target=/opt/splunk/lib/python3.7/site-packages markupsafe==2.0.0 --force --upgrade   Then restart splunk. As I'm sure you're aware, this is absolutely a hack... Happy app-building 🙂 ... View more

I'm getting these same errors when running the upgrade readiness app. Do these need to be fixed prior to upgrading to 9.0? I'm on 8.2 today. ... View more

Hi @triptraptresko ! If you were using the older viz.line type visualization, you would be correct about using the option fieldColors - however, you're using the newer splunk.line type, which uses an option called seriesColorsByField to accomplish the same thing.  Try swapping the name of the options and it should work!     ... View more