Hi Is there any way to decrypt or retrieve the clear‑text password for an identity stored in Splunk DB Connect? We are using Splunk DB Connect version 4.2.1.  /opt/splunk/bin/splunk show-decrypted --value 'ax4HC6QvWnVxxxxxxxxxxxxxxxx' then the output - ax4HC6QvWnVxxxxxxxxxxxxxxxx echo 'ax4HC6QvWnVxxxxxxxxxxxxxxxx' | /opt/splunk/bin/splunk cmd openssl enc -aes-256-cbc -d -pass file:/opt/splunk/etc/apps/splunk_app_db_connect/certs/identity.dat bad magic number Please let me know if there is any method to obtain the password in readable (clear‑text) form. ... View more

We are attempting to upgrade Splunk Universal Forwarders using the UF Remote Upgrade Add-on. As per Splunk documentation, we have installed the add-on, placed the required upgrade packages in the appropriate directories and pushed the app to the target clients via the Deployment Server. However, the upgrade is not taking place and we are seeing the following error in the log file located at /opt/splunk/var/log/splunk/upgrader_package_delivery.log: Error log from  /opt/splunk/var/log/splunk/upgrader_package_delivery.log 2025-09-22-14:22:10 Conf file from UF updater does not exist at "/opt/splunk/var/run/splunk/splunkupdater/info". The UF updater is likely not installed or running. 2025-09-22-14:22:10 Cancelling package delivery and waiting for next interval. 2025-09-22-14:23:10 Checking if any forwarder packages are available 2025-09-22-14:23:10 Found files in /opt/splunk/etc/deployment_apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages. Will deliver them. splunk_app_uf_remote_upgrade_linux/ ├── bin │   └── SPLUNK_UPDATER_INTERNAL_deliver_pkg.sh ├── default │   ├── app.conf │   ├── inputs.conf │   ├── local_config │   └── packages │   ├── splunk-upgrader-linux-102.tgz │   └── splunk-upgrader-linux-102.tgz.sig ├── local │   ├── app.conf │   ├── local_config.bkp │   └── packages │   ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz │   ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sha512 │   └── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sig ├── metadata │   └── local.meta └── VERSION Note: Splunk enterprise is running with version 10.0.0 and UF is running with 9.4.2 ... View more

Hi Please assist how to build Splunk deployment servers clustering with minimum requirement.  ... View more

I have an SSL certificate .pem provided by my organization and I need to configure it in Splunk HF. Please assist with any document referrals or steps. I have already gone through the Splunk documentation below but had no luck https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/ConfigureandinstallcertificatesforLogObserver ... View more

Hello, team I've made script, which uses the sudo command. I've deployed it on my forwarders and I get the error: message from "/opt/splunkforwarder/etc/apps/app/bin/script.sh" sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? Please help to fix this issue.  ... View more

Hi I am attempting to integrate Microsoft Azure with Splunk Enterprise to retrieve the status of App services. Could someone please provide a step-by-step guide for the integration? I have attached a snapshot for reference. ... View more

Hi All, How to Monitor Ping Status of Linux and Windows Servers in Splunk Enterprises.? Is there any Splunk supported Addon or script available ? Kindly help me on this.  Thanks and Regards, Madhu M S  ... View more