Hi there, after investigation my Search Head instance I found this in my task bar. Can somebody say is it expected behaviour? ... View more

Hello there. After updating from 9.3.1 to 9.4.1 my KVstore stoped working. During quick investigation I found the following errors: 2025-03-19T14:35:15.556Z I NETWORK [listener] connection accepted from 127.0.0.1:41888 #1188 (1 connection now open) 2025-03-19T14:35:15.566Z E NETWORK [conn1188] SSL peer certificate validation failed: unable to get issuer certificate 2025-03-19T14:35:15.566Z I NETWORK [conn1188] Error receiving request from client: SSLHandshakeFailed: SSL peer certificate validation failed: unable to get issuer certificate. Ending connection from 127.0.0.1:41888 (connection id: 1188) openssl s_client -connect 127.0.0.1:8191 -showcerts  gives me valid certificate info. Any idea why I receive this errors? Thx   ... View more

Could you please confirm whether Splunk utilizes TLS/SSL for the following communications by default or it should be manually configured: Between Search Heads and Indexers Between Indexers (Index Clustering) ... View more

Hi, I just installed a index cluster and i already know that i shoud place Apps to $SPLUNK_HOME/etc/master-apps/ directoty at my manager node to distribute it accross all indexers but i have 2 questions. 1. If an app that I deployed on the indexers uses Python scripts to fetch data, will this data be duplicated? 2. Do I need to prepare an app before deploying it to my indexers (remove unnecessary dashboards, eventtypes, etc)? Or can i leave it without changes? ... View more

After configuring my indexer and forwarder to use SSL I receive the following error: Error encountered for connection from src=MY_IP:44978. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol output.conf on  forwarder: [tcpout:group1] server = INDEXER_IP:9998 disabled = 0 sslVerifyServerCert = true useClientSSLCompression = true inputs.conf on indexer: [splunktcp-ssl:9998] disabled = 0 connection_host = ip [SSL] serverCert = /opt/splunk/etc/auth/mycerts/my_prepared_cert.pem requireClientCert = false output of openssl s_client -connect INDEXER_IP:9998 SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 4E137F80E8629FC675460A5B2A5E13305F5DE4153720F7A2566A7ED2490EF77C Session-ID-ctx: Master-Key: 7AD057B736D12AD4CA0515CF7E7AE9BDB1BB45A05F75DA6042A1A5460110D886BB80BEE06A79CFE94428D33A51B76009 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - e4 37 a8 12 91 c0 0c a0-6e 1b c5 01 31 98 3f 80 .7......n...1.?. 0010 - 95 9b 8d 47 c5 a3 99 33-49 2a f0 86 7f 80 e8 2c ...G...3I*....., 0020 - b7 4e 80 23 ec 4e 0e c6-20 b5 70 9c f9 cd 7d bd .N.#.N.. .p...}. 0030 - 69 93 82 ec 9d 37 51 ba-47 8e a6 23 cb 51 7f 4e i....7Q.G..#.Q.N 0040 - 1f 59 8b 8b 06 c4 dc 23-f9 64 61 69 ea e3 c3 39 .Y.....#.dai...9 0050 - 79 eb 82 a2 5c 0c 28 32-a1 2a a5 a8 50 41 95 54 y...\.(2.*..PA.T 0060 - 5a f6 6d 53 cd 12 d3 34-fe 18 00 50 e0 06 2c 77 Z.mS...4...P..,w 0070 - 0f b9 35 03 a5 08 a2 df-88 23 39 c8 8e b5 81 67 ..5......#9....g 0080 - 71 c1 4e 7a ab 8f b8 36-59 1a 01 ae 7e a6 36 c0 q.Nz...6Y...~.6. 0090 - 5e c2 6e 4f 1d 9f 47 76-cc 38 0e a5 26 91 50 de ^.nO..Gv.8..&.P. Start Time: 1716539462 Timeout : 300 (sec) Verify return code: 0 (ok)   ... View more

Hello there! After following this docs https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/Howtoself-signcertificates, https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/HowtoprepareyoursignedcertificatesforSplunk, https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/SecureSplunkWebusingasignedcertificate for SSL certificate installation I receive an error message when I tried to restart Splunk: Cannot decrypt private key in "/opt/splunk/etc/auth/mycerts/myServerPrivateKey.key" without a password web.conf [settings] enableSplunkWebSSL = true privKeyPath = /opt/splunk/etc/auth/mycerts/myServerPrivateKey.key serverCert = /opt/splunk/etc/auth/mycerts/splunkCert.pem Any solutions for this issue will be appreciated! ... View more

I need to connect data from a third party application via HEC to Splunk. It sends data in this format 1 event per request: { "field1":"value", "field2":"value" } After looking at the documentation for HEC, I discovered that for events to work correctly, they must have the following format: { "event":{ "field1":"value", "field2":"value" } }  Otherwise I receive an error: {"text":"No data","code":5} I don't have the ability to change the event format on the third-party application side. How can this problem be solved? ... View more

I have the following SPL search.   index="cloudflare" | top ClientRequestPath by ClientRequestHost | eval percent = round(percent,2) | rename count as "Events", ClientRequestPath as "Path", percent as "%"    Wich give me this result. I also need to group it by 10m time range and calculate the difference in percents between 2 previous time ranges for every line. Help me figure out how do that, thx. ... View more

I need to calculate the average number of events in the last hour and compare it with the number of events in the last 10 minutes for each host. index="cloudflare" | spath path=ClientRequestHost output=host | stats count as event_count by host | eval avg_count_of_events = round(event_count/6) | map search="search index=cloudflare ClientRequestHost=$host$ earliest=-10min | stats count as last_count_of_events | eval host=$host$ | eval avg_count_of_events=$avg_count_of_events$ | eval event_count=$event_count$ " | eval percent_of_increase = round((last_count_of_events/avg_count_of_events)*100)-100 | table host avg_count_of_events last_count_of_events percent_of_increase Is the more effective way to do that? ... View more