Splunk inputs support TLS-level certificate authentication. If you set requireClientCert=true, you can - as the name says, require all connecting forwarders to present a valid certificate. There are additional settings which can limit access to specific SANs only. Then you configure your local forwarders to use client certs when connecting and you're set. IP limiting is a standard feature on inputs. One caveat - since we're talking about Cloud, you might have to contact support to set up the authentication on the Cloud's side. WebUI access is another thing. I don't think you can authenticate users with certs here but - honestly - I don't see the point. ... View more

if you mean to disallow OS user to see/list content of the splunk folder, then it can easily be done with OS permissions. But most of the configuration can be accessed via Splunk UI or REST API, directly or using a suitable app like this: https://splunkbase.splunk.com/app/4353/ The one way to achieve your goal would be to rewrite the SPL logic with C++ or python and build custom splunk commands/lookups: https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/ https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Configureexternallookups ... View more

I'm seeing postinstall failure as well. The error logs are a little different from ssattler's though. I'm running Splunk 7.3 and it's a new installation of ES. My server has 16 cores and 48GB memory. 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: Error enabling the threat_intelligence_manager://da_ess_threat_default modular input 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: [HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/DA-ESS-ThreatIntelligence/data/inputs/threat_intelligence_manager/da_ess_threat_default/enable; [{'code': None, 'text': 'Not Found', 'type': 'ERROR'}] 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/deploy_manager_inputs.py", line 45, in deployManagerInputs 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: uri, sessionKey=session_key, method='POST') 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 550, in simpleRequest 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: raise splunk.ResourceNotFound(uri, extendedMessages=extractMessages(body)) 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/DA-ESS-ThreatIntelligence/data/inputs/threat_intelligence_manager/da_ess_threat_default/enable; [{'code': None, 'text': 'Not Found', 'type': 'ERROR'}] 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: Error retrieving manager inputs to deploy 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: ('Error enabling the %s modular input', u'threat_intelligence_manager://da_ess_threat_default') 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/deploy_manager_inputs.py", line 57, in deployManagerInputs 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: raise Exception('Error enabling the %s modular input', name) 11-06-2019 14:08:30.223 ERROR ChunkedExternProcessor - stderr: Exception: ('Error enabling the %s modular input', u'threat_intelligence_manager://da_ess_threat_default') 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/essinstall.py", line 209, in do_install 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: output = fn(session_key, True) 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 54, in wrapper 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: r = f(self, *args, **kwargs) 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 539, in stage_postinstall 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: self.postinstall(session_key) 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 303, in _postinstall 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: raise InstallException(str(e)) 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: InstallException: Error retrieving manager inputs to deploy 11-06-2019 14:08:30.224 ERROR ChunkedExternProcessor - stderr: postinstall failed. 11-06-2019 14:08:30.226 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PREVIEW 11-06-2019 14:08:30.235 INFO ReducePhaseExecutor - Ending phase_1 11-06-2019 14:08:30.235 INFO UserManager - Unwound user context: admin -> NULL 11-06-2019 14:08:30.235 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='adminadminSplunkEnterpriseSecuritySuite_RMD55ec2a61538835c15_1573070873.9', username='admin') 11-06-2019 14:08:30.235 INFO UserManager - Unwound user context: admin -> NULL 11-06-2019 14:08:30.235 INFO UserManager - Unwound user context: admin -> NULL 11-06-2019 14:08:30.239 INFO UserManager - Unwound user context: admin -> NULL ... View more

Is there any network latency? ... View more

For the user names: don't think you can solve that with 'intelligent text pattern matching', this calls for a lookup that holds all possible usernames of a person and maps them to some standardized identity. For calculating how closely 2 strings match, you could perhaps use the Levenshtein algorithm. I know the URL Toolbox add-on provides that. But perhaps there are better approaches for recognizing addresses. You might want to do a quick search on Google for that (as that is of course not a Splunk specific challenge). ... View more

If its a one time thing, you can do it in one go. It will however lead to a violation. Search will stop at the third violation. To understand more about license violations: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutlicenseviolations ... View more

I had to do this once for a huge CSV, but I also has to prune a few rows, and didn't need half the columns, (so not exactly the same as your requirement) I actually opted to do this with a python scripted input, which allowed me to pre-process the file as it went in, and dumped to stdout as key=value pairs. Once it was completed I disabled the input, but it meant I had the ability to run it again if ever needed. I never did need it again, but even so, It was time well spent making sure the data was concise when it went in. ... View more