Hi All, I am trying to list all tokens via splunk http-event-collector cli and it retruned error as below: [centos8-1 mycerts]$ ~/splunk/bin/splunk http-event-collector list -uri https://centos8-1:8089 ERROR: certificate validation: self signed certificate in certificate chain Cannot connect Splunk server I used openssl to try to connect to my server, it returned code 0. However, if I used the splunk openssl, it will return code 19. And from splunkd.log it said: 01-14-2023 01:25:22.088 +0800 WARN HttpListener [75758 HttpDedicatedIoThread-6] - Socket error from 192.168.30.128:59764 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name. Once I commented out cliVerifyServerName in servers.conf, the cli works but with warning as below: WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. May I know if I missed any configuration here? The cert is generated on my own and indeed it is self-signed one. ... View more

I am trying to list existing HEC tokens with curl command as below:     curl -k -u admin:<admin_password> http://<splunk_enterprise_instance_ip>:8089/servicesNS/admin/splunk_httpinput/data/inputs/http -v     It retruned as below:     * Trying 192.168.30.128... * TCP_NODELAY set * Connected to 192.168.30.128 (192.168.30.128) port 8089 (#0) * Server auth using Basic with user 'admin' > GET /servicesNS/admin/splunk_httpinput/data/inputs/http HTTP/1.1 > Host: <splunk_enterprise_instance_ip>:8089 > Authorization: Basic YWRtaW46UGFzc3dvcmQwMTIzIQ== > User-Agent: curl/7.61.1 > Accept: */* > * Recv failure: Connection reset by peer * Closing connection 0 curl: (56) Recv failure: Connection reset by peer     From splunkd.log:      01-09-2023 11:42:33.082 +0800 WARN HttpListener [3447 HttpDedicatedIoThread-0] - Socket error from <splunk_enterprise_instance_ip>:38846 while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request     It seems this is ownign to SSL. However, I have disbaled SSL in both Splunk Enterprise Instance and HEC, from inputs.conf:     [dujas@centos8-1 local]$ cat /home/dujas/splunk/etc/apps/splunk_httpinput/local/inputs.conf [http] disabled = 0 enableSSL = 0     May I l know how I could make the http work? Thanks. ... View more

Hi All, I am new to the UF on Windows and here is the deployment in my lab: 1 Splunk Enterprise instance running on Centos8 1 UF running on Windows pointing to the instance above For now, I am able to retrieve the events on seach bar like "host="DESKTOP-JQJVH8A" source="WinEventLog:Security"". What I am confused is about the configuration file: outputs.conf: D:\SplunkUniversalForwarder\etc\system\local inputs.conf: D:\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local Why is the inputs.conf not in the same directory as outputs.conf, is this owning to the installation? Say I would like to add some more stanzas in the inputs.conf, do I need to create a new inputs.conf in etc\system\local or modify the existing one in etc\apps\SplunkUniversalForwarder\local? Thanks. ... View more

Hi Splunk gurus, I have a deployment like below: 3 nodes as Search Head cluster, 3 nodes as Search peers and 1 manager node of this indexer cluster. The SHC is connecting to the indexer cluster via https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster#Integrate_with_a_single-site_indexer_cluster When I quarantined one of the indexers(search peers), it did say that one of the indexers is excluded,  this only showed up in the web page of manager node (which is working as a search head as well) but not in the page of any other search head, is this normal? Thanks. ... View more