Still an issue in 9.3.2   The concept of "ignore all INFO level" messages doesn't sit with me well as a solution, there are useful messages at that level. ... View more

Gravedigging for karma / answering questions left unanswered: This would be set in most cases on the receiving indexers props.conf.  And you are very right, in no case should ../default/ be modified. Create a ../local/ or a whole new app if you'd like with a ../local/props.conf If all you do is modify a local props.conf by adding a sourcetype stanza with TZ, there's no requirement to restart splunk, it should detect that change on its own. ... View more

Thanks for the insight. Does this also mean that, once authenticated with hypothetically stolen account credentials, an attacker could retrieve plaintext passwords simply with REST commands? ... View more