I need to make sure the AUP message pops up and is accepted anytime people log into the web interface on search heads. I have this working on a simple single server instance of Splunk. I need it to work on a distributed search head configuration. This is the process that works on single instances with user pw authentication only instead of the smart card authentication we use for our production environment. Create tos app Use web interface and go to manage apps Create app, not visible from cmd line vi ./splunk/etc/apps/tos/tos.conf Create the html file to hold the DoD Banner text vi ./splunk/etc/system/static/46.html Insert the banner text save using ZZ Check ownership and permissions chown splunk ./splunk/etc/system/static/46.html chgrp splunk ./splunk/etc/system/static/46.html chmod 444 ./splunk/etc/system/static/46.html Edit web.conf with vi to point to location of DoD html file vi ./splunk/etc/system/local/web.conf insert the following stanza: [settings] # Warning and Acceptance Banner termsOfServiceDirectory = /opt/splunk/etc/system/static/ save using ZZ check ownership and permissions chown splunk ./splunk/etc/system/local/web.conf chgrp splunk ./splunk/etc/system/local/web.conf chmod 600 ./splunk/etc/system/local/web.conf Restart Splunk stop splunk cd ./splunk/bin/ ./splunk stop wait restart splunk ./splunk start Log on through web interface to verify success using btool ./splunk btool web list --debug I see tons of entries and many web.conf paths that are in the ./splunk/etc/app/...... which one is the relevant one in a distributed system? I tried the ./splunk/etc/system/default. It killed our smart card authentication and did not pop up a banner. ... View more

Hi, We use a few stand alone systems for scanning media and other tasks in our group. We are required to retrieve and archive these logs and since we use Splunk to do just that for everything else we want to work out a way to do the same with these systems. They are never plugged into the network and all movement of data in and out of these machines is via portable media. What is the best way to do this? I want the data to end up indexed the same way that online systems are. Is there a way to use a fowarder on the stand alone system to write to a file that is easily consumed by Splunk or should I just massage the exported csv files from the Windows logs? Cheers! ... View more

OK, We are standing up several new instances of Splunk 7.x and my Dev instance needed certs installed. I did this the other day and afterward the web service would not start. This was because some of the cert files were incorrectly placed. We fixed that and got Splunk to start at the log on page. I authenticated then got a 500 error. Not sure why that happened with my Dev versus the Prod instances which went without a hitch. I would like to undo all the certs we installed and take the system back to where it was previously but I did not save the .pem files that were there to begin with. Is there a way to regenerate the ca.pem etc,.. files without doing a reinstall or is there something I missed that could be fixed. I have not been able to access the Splunk web logs but will have them within the hour. ... View more