Updated path to the docs. https://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards ... View more

My personal opinion is Best Practices are just that. Good things to do in most cases, but there are times where a system owner will decide that because of a specific requirement to do it differently. However, for your asset tracking use case if the external system doesn't maintain history of old assets, or older information about current assets you might want to indexing it so you can link it with old data in a historical security investigation. ... View more

For the paranoid among us, you might want to follow this with either history -c to clear all your history or history -d <linenum> to delete the line with the password from your history file. ... View more

What's happening is OpenSSL is trying to create/modify ~splunk/.rnd and can't. To resolve, check /etc/passwd to see where the system thinks the home directory, and then make sure it exists with the correct permissions. In theory you could set splunk's home directory to your install location, but there may or may not be security implications of having the .rnd in $SPLUNK_HOME . I'm still working on grocking the full Splunk security model, but I'm sure the ultimate solution is to not user the self signed certificates and install real certificates. ... View more