We want to use splunk deployer to push our addon to the search headers, but have questions about the encrypted information. First of all, if I understand it right, the addon has to be setup from the deployer, right? The setup link won't even show up in a search head for an addon. During the setup of our addon there are some passwords we take from the user, and we need to store them for later use. We post them to the storage/passwords endpoint. So the passwords will be encrypted in the password.conf. Now if the deployer push this addon to the search heads, how can they decrypt these please? Thanks. ... View more

After I installed "Splunk Machine Learning Toolkit" to the deployer (as a test), I want to push it to the search head cluster. But the "splunk apply apply shcluster-config ....." command shows an error ".../splunk/etc/shcluster is likely empty". I checked the folders. Apparently the above app has been installed to ....../splunk/etc/apps folder, not the shcluster folder. What did I do wrong please? Do I need to copy it manually to the shcluster folder? Or does it mean I setup the deployer incorrectly? Thanks! ... View more

Hello, We have an AR Action, and it works fine with correlation search. But when we try to invoke it as adhoc action, it failed with the following error message: ActiveResponseException: Invalid parameter for adhoc modular action. Now we use sendalert command in our alert_actions.conf, so according to the Splunk document, it should support adhoc invocation. The command we use in our alert_actions.conf follows the Splunk example for adaptive response: command = sendalert $action_name$ results_file="$results.file$" results_link="$results.url$" param.action_name=$action_name$ | stats count None of the log files in $SPLUNK_HOME/var/log/splunk folder provides useful information. How can we debug this please? Thanks! ... View more

Hello, We want to enable Splunkd SSL, so we put enableSplunkdSSL = true to server.conf. We generated a certificate using the FQDN as the CN of the certificate. Then in our AddOn, we use splunk.getLocalServerInfo() to get the url:port. The problem is that splunk.getLocalServerInfo() always returns https://127.0.0.1:8089, even if we changed MgmtHostPort in web.conf. As a result, we always get an error: SSLError: hostname '127.0.0.1' doesn't match xxxxxx, where xxxxxx is the CN we set for the certificate. So how shall this work? Shall we use 127.0.0.1 as the CN to create a cert? Or we shall not call getLocalServerInfo()? Thanks! ... View more

Some of the certified custom Apps do not appear in the Browse More Apps pages. Why is that? Also how can I install those Apps to my Splunk Cloud free trail instance please? Thanks, ... View more