I am also digging into this. It is helpful to know that with newer Splunk stuff it has been moved to a different website. How to prepare TLS certificates for use with the Splunk platform | Splunk Docs looks like Splunk changed how some of the stuff works in 9.4 - 10. That being said the above link is a good way to verify if your pem files are correct. Currently we are stuck on the: SAN OtherName not found for configured OIDs in client certificate CertBasedUserAuth: error fetching username from client certificate ... View more

1. It's an old thread. It's often that people aren't even active on Answers after several years. 2. An index is just a place for events "storage". Whether props/transforms work or not is not index-specific (ok, it _can_ be made index-specific but you have to work to explicitly make it so; you can safely assume that it's a very very unlikely case). So if your index-time mechanism doesn't work, it's either defined in a wrong place (where do you have your settings defined?) or is not written properly. ... View more

Agree 100%.  Hope they consider implementing a self-updating feature if they expect to have the frequency of updates that come along with postgresql. ... View more

Having the same problem had to go back to the <p></p> method that was previously in the interim. ... View more