Upgrades as in product updates in the installers? As this was built from new, hasn't been upgraded from any previous version as its a new deployment  ... View more

output of the btool check below? Invalid key in stanza?   ... View more

I'm not sure whether that's a good or bad thing then, now literally nowhere to look. I was hoping id added a parameter wrong, or sausage fingered something... **bleep**!   Yup been rebooted numerous times, all without any joy ... View more

Output as below: [root@ts-test-splnkhvf local]# /opt/splunk/bin/splunk btool outputs list [rfs] batchSizeThresholdKB = 2048 batchTimeout = 30 compression = zstd compressionLevel = 3 dropEventsOnUploadError = false partitionBy = legacy [syslog] maxEventSize = 1024 priority = <13> type = udp [tcpout] ackTimeoutOnShutdown = 30 autoLBFrequency = 30 autoLBFrequencyIntervalOnGroupFailure = -1 autoLBVolume = 0 blockOnCloning = true blockWarnThreshold = 100 channelReapInterval = 60000 channelReapLowater = 10 channelTTL = 300000 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256 compressed = false connectionTTL = 0 connectionTimeout = 20 connectionsPerTarget = 0 defaultGroup = proxy_indexers disabled = false dnsResolutionInterval = 300 dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 ecdhCurves = prime256v1, secp384r1, secp521r1 forceTimebasedAutoLB = false forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry|_metrics|_metrics_rollup|_configtracker) forwardedindex.filter.disable = false heartbeatFrequency = 30 indexAndForward = false maxConnectionsPerIndexer = 2 maxFailuresPerInterval = 2 maxQueueSize = auto negotiateNewProtocol = true polling_interval = 5 readTimeout = 300 secsInFailureInterval = 1 sendCookedData = true socksResolveDNS = false sslPassword = $7$Tb/iioBRZq72fj4tWQYjPXWK2NbNXQu503TG8B9t879bR8ihr1pDwNQFY+r0MlGEqxcozldWxXAkEfmEwcqYRKXF7esksFdHzwDJPLf8eJrDffdaTuBA7+IhHPr5kyxH sslQuietShutdown = false sslVersions = tls1.2 tcpSendBufSz = 0 useACK = false useClientSSLCompression = true writeTimeout = 300 [tcpout:proxy_indexers] server = inputs1.cubicfrankfurt.splunkcloud.com:9997, inputs2.cubicfrankfurt.splunkcloud.com:9997, inputs3.cubicfrankfurt.splunkcloud.com:9997,inputs4.cubicfrankfurt.splunkcloud.com:9997, inputs5.cubicfrankfurt.splunkcloud.com:9997, inputs6.cubicfrankfurt.splunkcloud.com:9997, inputs1.cubicfrankfurt.splunkcloud.com:9997, inputs8.cubicfrankfurt.splunkcloud.com:9997, inputs9.cubicfrankfurt.splunkcloud.com:9997, inputs10.cubicfrankfurt.splunkcloud.com:9997, inputs11.cubicfrankfurt.splunkcloud.com:9997, inputs12.cubicfrankfurt.splunkcloud.com:9997, inputs13.cubicfrankfurt.splunkcloud.com:9997, inputs14.cubicfrankfurt.splunkcloud.com:9997, inputs15.cubicfrankfurt.splunkcloud.com:9997 socksResolveDNS = false socksServer = 10.203.254.1:1080 [tcpout:scs] autoLBFrequency = 120 clientCert = $SPLUNK_HOME/etc/apps/100_cubicfrankfurt_splunkcloud/default/cubicfrankfurt_server.pem compressed = true disabled = 1 server = cubicfrankfurt.forwarders.scs.splunk.com:9997 sslAltNameToCheck = *.forwarders.scs.splunk.com sslVerifyServerCert = true useClientSSLCompression = false [tcpout:splunkcloud_20220204_9aaa4b04216cd9a0a4dc1eb274307fd1] autoLBFrequency = 120 clientCert = $SPLUNK_HOME/etc/apps/100_cubicfrankfurt_splunkcloud/default/cubicfrankfurt_server.pem compressed = false server = inputs1.cubicfrankfurt.splunkcloud.com:9997, inputs2.cubicfrankfurt.splunkcloud.com:9997, inputs3.cubicfrankfurt.splunkcloud.com:9997, inputs4.cubicfrankfurt.splunkcloud.com:9997, inputs5.cubicfrankfurt.splunkcloud.com:9997, inputs6.cubicfrankfurt.splunkcloud.com:9997, inputs7.cubicfrankfurt.splunkcloud.com:9997, inputs8.cubicfrankfurt.splunkcloud.com:9997, inputs9.cubicfrankfurt.splunkcloud.com:9997, inputs10.cubicfrankfurt.splunkcloud.com:9997, inputs11.cubicfrankfurt.splunkcloud.com:9997, inputs12.cubicfrankfurt.splunkcloud.com:9997, inputs13.cubicfrankfurt.splunkcloud.com:9997, inputs14.cubicfrankfurt.splunkcloud.com:9997, inputs15.cubicfrankfurt.splunkcloud.com:9997 sslCommonNameToCheck = *.cubicfrankfurt.splunkcloud.com sslVerifyServerCert = true useClientSSLCompression = true ... View more

This is what i'm seeing in the splunkd log. any ideas how to resolve it would be appreciated.  ... View more

Yes, granted its a bit vague, still trying to understand splunk and its components. Yes, aware its about SOCKS proxy, we have configured the service in the proxy server as per the symantec article and documentation. The use of the HTTP was to verify we could actually get this talking externally to something. We know its a different port, we have also configured the SOCKS requirements as per symantec and the article referenced above. Not ruling out misconfiguration to be honest, its becoming a bit of a minefield! If i log into the onprem deployment server, i can see the endpoints we have installed the UF on. So we are getting from the endpoint to the onprem servers fine. I dont see any further errors in the deployment server. I do see them in the heavy forwarder console, as such:     ... View more