Good morning, I’m hoping someone can help with an issue I’m running into. Is anyone currently using CAC authentication for Splunk Web login on Splunk 10.x? We previously had this working on Splunk 9.4 running on Windows Server 2016 without issues. However, after building a new server on Windows Server 2022 with Splunk 10.0.2, I have not been able to get CAC authentication working. When attempting login, I receive an XML page with “ERROR Unauthorized.” SSL/TLS is working successfully on the Splunk Web portal. The server_certificate.p7b was generated from the NPE portal and converted to a cert.pem that includes the full certificate chain (subordinate and intermediate CAs up to the root CA). Where I’m still unclear is the cert_chain_created.pem file. Based on my research (though I may be mistaken), this file should contain the subordinate and intermediate CA certificates that issued both the user CAC certificates and the Splunk server certificate. In our environment, both certificate chains terminate at the same root CA. Another difference I’ve noticed is that in our previous configuration we used a .key file for privKeyPath in web.conf , but current documentation references using a .pem file instead. I’m unsure whether this is expected behavior with newer Splunk versions or something specific to Windows Server 2022. I’ve been following the Splunk Lantern guide on configuring CAC authentication, but I’m still unable to get it working. If anyone has CAC authentication working on Splunk 10.x (especially on Windows Server 2022), I’d really appreciate any guidance or confirmation on certificate file structure and configuration changes. Thank you in advance. ... View more

Hi Splunk Community, I recently upgraded my Splunk Universal Forwarders from version 9.4.3 to 10.0, and since the upgrade, I’ve been experiencing issues with the forwarders sending security logs to my Splunk Enterprise instance (which is also running version 10.0). Here are some specific details: Pre-upgrade, everything was working fine, and security logs were being ingested without any issues. After the upgrade, I noticed that security logs are either not getting sent or are being delayed significantly. I've verified that the forwarders are still forwarding some logs, but the security-related ones aren't appearing in the index as expected. The configuration files (inputs.conf, outputs.conf, etc.) on the forwarders haven’t been changed since the upgrade. I’ve tried restarting the forwarders and re-checking the connectivity to the Splunk Enterprise instance, but the issue persists. Has anyone else encountered similar problems after upgrading to 10.0? Could it be an issue with compatibility, or is there something specific I should look into? Any advice or troubleshooting tips would be greatly appreciated! Thanks in advance for your help! ... View more