Hello @Hutch  We haven't found a solution so far. Any idea? Cheers, Daniel ... View more

So if you're talking about a replacement of self signed splunk certificates and activation of ssl encryption for mgmt. port, rep. port, UF --> Indexer and so on. Following links could be helpful! https://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwithSSL https://docs.splunk.com/Documentation/Splunk/latest/Security/Getthird-partycertificatesforSplunkWeb https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate https://docs.splunk.com/Documentation/Splunk/latest/Security/Howtogetthird-partycertificates https://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates https://docs.splunk.com/Documentation/Splunk/latest/Security/HowtoprepareyoursignedcertificatesforSplunk https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousethedefaultcertificate https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousesignedcertificates ... View more

I agree with @richgalloway . ... View more

@richgalloway that worked!  ... View more

Hi @Hutch,   good for you, see next time! Please accept one answer for the other people of Community Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @hammy, it isn't a good idea adding a new question to an existing and solved question, even if with the same issue, because probably you'll never have an answer; so, I hint to create a new question with your requirement. Anyway, your questions aren't clear for me: what's the problem to use source or sourcetype? you can easily rename one of them using AS, e.g. the one in the lookup. What do you mean with alerttime: the timestamp of the event or what else? Ciao. Giuseppe ... View more

Located the issue! It appears that there was an additional app that was also attempting to change the time. I was also using the wrong TZ. I ended up removed the TZ=America/Chicago from system/local/props.conf and putting TZ=UTC in the app instead which resolved the issue.  ... View more

Saved searches are reports and alerts. There used to be a distinctive functional difference ages ago as far as I read but now it's mostly a cosmetic difference that they are presented as different types in the ui. If you call rest endpoint /services/saved/searches you'll get a list of both - reports and alerts - together. ... View more