We have a new Splunk Cloud environment We are using AWS TA Add On to ingest files from S3 The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values). The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly. Is there any way to turn-off the CSV parsing ability of the S3 input? Source: https://docs.splunk.com/Documentation/AddOns/released/AWS/S3 "The Generic S3 custom data types input processes .csv files according to their suffixes" ... View more

We are trying to use Splunk stream on a webserver with IIS, using https based site. Web server is listening on port 8443. DiffieHelman is disabled on that IIS server. We ran the following: Install universal forwarder on IIS server Install Splunk_Stream_TA on the uf Install the private key on streamfwd Configure from Stream UI on the search head to capture the following: HTTP src_port 8443 OR dest_port 8443 TCP src_port 8443 OR dest_port 8443 Restart splunkfwd As a results we do not get HTTP events, just TCP events with unreadable content. We also see in streamfwd.log the following: stream.SSL - SSL decryption error (cannot decrypt ephemeral session) stream.packetProcessor - SSL record decryption error (corrupted data?) (ssl) [c=10.0.0.1:45674,s=10.0.0.2:8443] To investiage and eliminiate networking and promiscous mode issues. we used the openssl guide to simulate the same scenario without IIS: https://superhero.ninja/2015/07/22/create-a-simple-https-server-with-openssl-s_server/ Using openssl as a webserver on the same UF, Stream was able to successfuly decrypt the data. We received both TCP and HTTP events. Any idea what could be the issue? ... View more