We have got below vulnerabilities on Splunk servers, please help how to resolve it insecure cipher suites: * TLS 1.2 ciphers: * TLS_RSA_WITH_AES_128_CBC_SHA256 * TLS_RSA_WITH_AES_128_GCM_SHA256 * TLS_RSA_WITH_AES_256_GCM_SHA384 ... View more

i am using transaction command to check the start time and end time of a transaction.  I have used: | transaction TxnId startswith="NEW TXN" endswith= "statusY" keeporphans=true | eval starttime=_time | eval endtime=_time+duration | eval starttime=strftime('starttime', "%Y-%m-%d %H:%M:%S.%3N") | eval endtime=strftime('endtime', "%Y-%m-%d %H:%M:%S.%3N") | table TxnId starttime endtime I want to check if all transactions have start time and end time for the success rate. Now even if the endswith="statusY" is not there, it is calculating its end time.  What can i do to make sure there should be no end time if the condition endswith="statusY" is not there. And if the condition of both startswith and endswith is met table should show status as success or else blank.   ... View more

Hello, I know we can send alerts from Splunk to BMC TrueSight. But i would like to get help on sending the events generated at BMC TrueSight to Splunk. Please help to know if there is any way to do it.   Thanks! ... View more

Hello All, I have to load balance the https requests over indexer cluster.  Need to know the best approach to load balance the data. Is NGNIX is only solution? ... View more

I was trying to get DaemonSet up and running got below errors while getting pods ready [error]: #0 unexpected error error_class=Errno::EACCES error="Permission denied @ rb_sysopen - /var/log/splunk-fluentd-kube-audit.pos" 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/plugin/in_tail.rb:241:in `initialize' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/plugin/in_tail.rb:241:in `open' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/plugin/in_tail.rb:241:in `start' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:203:in `block in start' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:192:in `block (2 levels) in lifecycle' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:191:in `each' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:191:in `block in lifecycle' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:178:in `each' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:178:in `lifecycle' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/root_agent.rb:202:in `start' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/engine.rb:248:in `start' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/engine.rb:147:in `run' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/supervisor.rb:717:in `block in run_worker' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/supervisor.rb:968:in `main_process' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/supervisor.rb:708:in `run_worker' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/lib/fluent/command/fluentd.rb:372:in `<top (required)>' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/bin/fluentd:15:in `require' 0 [error]: #0 /usr/share/gems/gems/fluentd-1.14.2/bin/fluentd:15:in `<top (required)>' 0 [error]: #0 /usr/bin/fluentd:23:in `load' 0 [error]: #0 /usr/bin/fluentd:23:in `<main>' [error]: #0 unexpected error error_class=Errno::EACCES error="Permission denied @ rb_sysopen - /var/log/splunk-fluentd-kube-audit.pos" 0 [error]: #0 suppressed same stacktrace ... View more