About kaboom1

kaboom1 · ‎06-19-2024

Hello all, I need to configure SAML/SSO with Splunk but i m having the following issues: - I have 3 search heads in a cluster (without a load balancer 😕) => I can create a dedicated SAML config for each search head and disable the replication of the authentication.conf - we have many tenants and we have users connecting from the different tenants to Splunk (currently we have multiple LDAP configurations) => I understood that Splunk only accepts one IdProvider with SAML, so users from other tenants will not be able to access splunk with SSO. - ideally, we must have some users connecting with LDAP, but Splunk doesn't allow enabling both LDAP and SAML simultaneously 😕 or it is possible but requires a custom script for that. Questions: 1- does anyone have worked on a script to enable LDAP and SAML ? 2- Any idea about the best config from Azure ID regarding the multi-tenants and the B2B collaboration? 3- Any advice in general how to better approach this issue? 🙏 Best

kaboom1 · ‎01-15-2024

Hello, I am looking for any guidance, info about the possibility of using Microsoft AMA agents to forward logs to splunk instead of using Splunk universal forwarders. I know you will say but why?! lets say I have some requirements and constraints that oblige me to use AMA agents 🙃 I need to know the feasibality of this integration and if there are any known issues or limitations. Thanks you for your help. (excuse me if my question is vague, i am kinda lost here 😕)

isoutamo · ‎01-03-2024

Hi If you cannot connect to LM from peer, you have 72h time to fix the situation. After that you cannot do normal searches before you fix it. There is no automatic timeout for getting it work again! You must check that you have connection from your peer to LM usually it use port 8089. Also you must have same pass4SymmKey on generic stanza on peer and LM to get connection to work. If physical connection between host is working then just look from LM's _internal log what is the reason why it didn't accept peers connection. r. Ismo

kaboom1 · ‎11-02-2023

Hello everyone, Here is the story, we have a search head cluster with three members, lets call them sh1, sh2, sh3. these 3 search heads are not in the same domain/vlan, so each one used to have its own config of the SMTP server. Now we are having issues sending reports from Splunk. and I noticed that all 3 search heads are using just one SMTP server so the emails will not be delivered. I tried to put the correct config for each search head in .../system/local/alert_actions.conf but still not working. For now I will try to allow the search heads to communicate with all SMTP servers. but i am not sure it is the best solution. Is there a config I am missing about the email setting in a search head cluster? Thank you.

kaboom1 · ‎10-12-2023

Thank you for your message, I checked all occurrences of the original app name in all files and I found that in many .py files the original name was used, so i replaced those with the new name. Now the inputs.conf seems to work and I can see logs, the issue I have now is that the UI of the app shows a new error: "Configuration page failed to load, the server reported internal errors which may indicate you do not have access to this page." I am checking again what other replacements I need to do.

gcusello · ‎08-23-2023

Hi @kaboom1, this isn't a question for the Community, this request requires analysis and design from a Splunk Architect otherwise you have a big risk. Anyway, all the considerations from @isoutamo are correct and you could use them, but I hint to ask to an Architect. Anyway, I use an HF when there's the request to segregate networks, in other words if you want to limit the channels between networks, you can use an HF (better two, to avoid Single Points of Failure) as a concentrator, so you have to open routes only for this server. If the clients in the subnetwork are less than 50, you can use the same HF as Deployment Server, but a twl leve Deployment Architecture, isn't so immediate ans still requires an Architect. Ciao. Giuseppe

kaboom1 · ‎06-05-2023

Thank you @richgalloway , indeed by simply selecting the option Restart Splunkd from the deployment server GUI (in Settings > Forwarder management > select your app then click Edit abd select: After installation: Restart Splunkd) logs start coming in 🙂

Posts	11
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎06-01-2023

Online Status	Offline
Date Last Visited	2 weeks ago

SAML/SSO setting with Azure ID multi tenants

Using Microsoft AMA agent to send logs to splunk

Search Head Cluster email setting between differen...

Splunk Add on not working after being pushed by de...

Splunk infrastructure recommendations

How can we read local data on HF and send them to ...

SAML/SSO setting with Azure ID multi tenants

Using Microsoft AMA agent to send logs to splunk

Re: Why are Licensing pages failing to render and ...

Search Head Cluster email setting between differen...

Re: Splunk Add on not working after being pushed b...

Re: Splunk infrastructure recommendations

Re: Read local data on HF and send them to indexer...