About kentsaunders

kentsaunders · ‎05-19-2022

Amksa86, I am experiencing the same problem. Did you find a solution? Splunk Universal Forwarder 8.2.6 Windows Core 2019 1809 Client: Mirantis Container Runtime Version: 20.10.9 API version: 1.41 Go version: go1.16.12m2 Git commit: 591094d Built: 12/21/2021 21:34:30 OS/Arch: windows/amd64 Context: default Experimental: true

kentsaunders · ‎01-11-2022

After reviewing DNS queries, Proxy logs and the VPC Flow logs it turned out that only the SNS service wouldn't use the proxy. I was able to resolve the issue by adding an SNS endpoint to the VPC/Subnet that the Splunk instance is connected to.

kentsaunders · ‎01-04-2022

After updating the Splunk Add-On for AWS to 5.2.1 we are no longer receiving Cloudtrail data through a proxy server. The message from the _internal index is "message="Warning: This message does not have a valid SNS Signature <urlopen error [Errno 110] Connection timed out>". If I bypass the proxy and allow outbound connections from the Splunk server on port 443 (with the proxy enabled in both the addon and server.conf) it is able to retrieve the data. We are running Splunk Enterprise 8.2.3.2 on a single instance.

Posts	3
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎04-09-2021

Online Status	Offline
Date Last Visited	‎05-20-2022 03:00 PM

AWS Addon - SNS Signature

Re: Splunk forwarder preventing Docker rebuild

Re: AWS Addon - SNS Signature

AWS Addon - SNS Signature