About robgarner

isoutamo · ‎09-28-2021

I think that you could copy data with props and transform and change index of another feed. Unfortunately I haven’t example in my hand, but I have seen quite similar case in one of my clients environment. r. Ismo

roden · ‎09-06-2020

Per the link you provided, useClientSSLCompression is part of the [tcpout] stanza, not the [SSL] stanza: https://docs.splunk.com/Documentation/Splunk/6.6.2/Security/ConfigureSplunkforwardingtousesignedcertificates#Configure_your_indexer_to_use_a_signed_certificates

robgarner · ‎07-18-2018

thanks. my initial experiments haven't been altogether successful, but i'll read and experiment a little more and let you know how i make out.

robgarner · ‎12-07-2017

Thanks for the pointer, I'll go grub through the app store a little more thoroughly. -R

robgarner · ‎06-22-2017

Very helpful, many thanks !

yannK · ‎06-07-2017

If the UI does not clarify the settings, you can check the configuration specifications, in particular the authentication.conf see : http://docs.splunk.com/Documentation/Splunk/latest/Admin/authenticationconf and the manual LDAP setup on the config file. http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureLDAPwithconfigurationfiles

isoutamo · ‎09-26-2017

And maybe also this can be the reason why you see it some times and some other time not. It depends which kind of time frame you are using on your search. If you are using real-time search then this button isn't there, but all other cases it is. -- Ismo

robgarner · ‎03-15-2017

Good idea. Will check out your link and see where it takes me. Many thanks for all your help ! 🙂

robgarner · ‎03-09-2017

I am so deeply grateful for this post - I think you just solved my problem.

Posts	19
Solutions	1
Karma Given	4
Karma Received	0
Member Since	‎03-09-2017

Online Status	Offline
Date Last Visited	‎02-08-2022 11:26 AM

Any way to send events to two indexes (on the same...

Primary search for earliest=-24h, with subsearch f...

How can I make the UF downloadable from the search...

splunk validate cluster-bundle throws error "inval...

Watching the watchmen: how to monitor splunkd from...

Seeking documentation re: LDAP strategies on a sea...

"Event Action" button not displayed for some users

Need more info about LDAP authorization internals

Re: Any way to send events to two indexes (on the ...

Re: splunk validate cluster-bundle throws error "i...

Re: Primary search for earliest=-24h, with subsear...

Re: How can I make the UF downloadable from the se...

Re: Watching the watchmen: how to monitor splunkd ...

Re: Seeking documentation re: LDAP strategies on a...

Re: "Event Action" button not displayed for some u...

Re: Need more info about LDAP authorization intern...

Re: LDAP authentication troubleshooting informatio...