I am trying to deploy Splunk 9.2.1 in air gapped environment.    As I go through STIG list to harden the system, one of the item asks me to turn FIPS and Common Criteria mode on. Turning FIPS mode on is easy but Common Criteria seems to have some other requirements. I am trying to read upon Common Criteria for Splunk but not 100% clear about it and also, not sure if I need it in air gapped environment.    Has someone here gone through enabling it? Can you please provide more info on it? Specially, if not needed, I can present that to my ISSO.  Thanks in advance.   ... View more

I installed Splunk Enterprise 9.2.0.1 without FIPS mode on and now I found out, I need to have it on. Luckily, I haven't done too much work, just one server and few Universal forwarders.    I believe, I have to scrap the current installation of SH/Indexer and all the UFs, correct? There is not way to enable it in current install as far as I can tell.   Also, are there any files, I could save, so I can reuse them?   ... View more

On my Splunk Master node, I can check the status if "All Data is Searchable, Search Factor is Met, Replication Factor is Met". Is there a way to check the status using CLI? Or what's the best way to set an alert, so if there is any issue, it emails me? ... View more

I have noticed that Splunk process on my development search-head shows not available abruptly. And then it becomes available. One of those time, I check the status of Splunk service and below is the output. Not sure, where to check and how to troubleshoot this problem. I was just assigned this problem, so not sure how often it happens but I have wrote a cronjob to check the status every 5 minutes and got an alert that it happened last night around 3am. But as far as I know, there is no pattern to it.    systemctl status splunk  splunk.service - Splunk Enterprise     Loaded: loaded (/etc/systemd/system/splunk.service; enabled; vendor preset: disabled)     Active: deactivating (stop-sigterm) (Result: exit-code) since Mon 2022-10-03 10:45:41 EDT; 41s ago   Main PID: 76827 (code=exited, status=8)     CGroup: /system.slice/splunk.service             └─78229 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py      Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: [  OK  ]  Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: All installed files intact.  Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Done  Oct 03 10:02:52 splunkbdev01.xxx.xxx splunk[76759]: All preliminary checks passed.  Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Starting splunk server daemon (splunkd)...  Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Done  Oct 03 10:04:31 splunkdev01.xxx.xxx sudo[78359]:   splunk : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/netstat -anp  Oct 03 10:04:31 splunkdev01.xxx.xxx sudo[78359]: pam_unix(sudo:session): session opened for user root by (uid=0)  Oct 03 10:04:43 splunkdev01.xxx.xxx systemd[1]: Started Splunk Enterprise.  Oct 03 10:45:41 splunkdev01.xxx.xxx systemd[1]: splunk.service: main process exited, code=exited, status=8/n/a  ... View more