I'm seeing the same message logged in mongod.log with Splunk v8.2.10 running on Windows Server. It is logged as Info ("I ACCESS") instead of Error ("E ACCESS"), so maybe it can be ignored? Not sure which location "storedKey" it is referring to: The expired Splunk local certificate was renewed a few months ago (server.pem), but there was still an old copy residing in Windows' certlm.msc repository. Updating the latter doesn't appear to fix the issue. Environment Variable  SSL_CERT_FILE pointing to server.pem doesn't help either. ... View more

Splunk Windows 8.2.10 (upgraded from 8.2.6) -  Who/What would put that in alert_actions.conf? [email] show_password = True   Should I: a. delete the alert_actions.conf file (nothing else is in the file) ? b. Change it to False? c. delete the file contents, but leave the empty file there? ... View more

@inventsekar wrote: the path was configured mistakenly i think. Where is that path configured in a Windows Splunk Enterprise installation?  Update: Looks like @rbreton answered it here in 2017! I need another Windows environment variable: OPENSSL_CONF = %SPLUNK_HOME%\openssl.cnf ... View more

Discovered when I was doing the following: C:\Splunk>%SPLUNK_HOME%\bin\openssl x509 -enddate -noout -in %SPLUNK_HOME%\etc\auth\server.pem WARNING: can't open config file: C:\\gitlab_runner\\builds\\build_home\\splunk/ssl/openssl.cnf notAfter=May 17 23:44:06 2026 GMT   ... View more

@PickleRick , it's a small system (mostly for dev work): everything on 1 Wintel Splunk Server; not distributed/clustered. A couple of remote machines that use a UF. ... View more

For the record, remote UF inputs.conf:   [monitor://C:\pathname\xyz.log] sourcetype = XYZ index = xyz disabled = 0   and Splunk Server props.conf:   [source::...\\xyz.log] sourcetype = XYZ   doesn't do it; the data from remote UF gets the right sourcetype, but still gets indexed into main not xyz. (The local xyz.log data coming from the Splunk Server directory gets the right sourcetype and goes into index xyz) Something on the Splunk Server is over-riding the explicit index specification on the remote UF? Going to try the other recommendation for props.conf and transforms.conf ... View more

@gcusello , that looks like a setup for local files. (I have that set up via Splunk's "Data inputs" --> "Files & directories") It does not seem to work for remote files coming in via the Splunk Universal Forwarder. They may have different drive letters and pathnames, but the same filename (xyz.log). ... View more