Splunk Search

Error "Command failed (ret=1), exiting" in Web.conf

snehalk
Communicator

Hello Everyone,

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Getthird-partycertificatesforSplunkWeb

I have followed above link to created SSL certificate. but when i executed splunk restart command got following error.

Starting splunkweb...  Generating certs for splunkweb server
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
...++++++
.......................++++++
writing new private key to 'privKeySecure.pem'
-----
Loading 'screen' into random state - done
Signature ok
subject=/CN=USADC-VSSPLDV01/O=SplunkUser
D:\Program Files\Splunk\D:/Program files/Splunk/etc/auth/splunkweb/Splunkcert.pem: Invalid argument
Command failed (ret=1), exiting.

my web.conf file contain

[settings]
enableSplunkWebSSL = true
privKeyPath= etc/\auth/\splunkweb/\mySplunkWebPrivateKey.key
caCertPath= etc/\auth/\splunkweb/\Splunkcert.pem

Please help me on this.

Thanks in advance

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The path listed as invalid looks like a mess with slashes and backslashes muddled together. Do try using Windows-style paths for your certificate files.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check what's going wrong in your browser. Connection refused, host unknown, timeout, wrong protocol, ...?
Also check for anything suspicious in Splunk's logs.

0 Karma

snehalk
Communicator

Hello @Martin Müller

Thanks for your reply.

i changed my web.conf file as below

 [settings]
enableSplunkWebSSL = true
privKeyPath= etc\auth\splunkweb\mySplunkWebPrivateKey.key
caCertPath= etc\auth\splunkweb\Splunkcert.pem

Running splunk restart command i got at end

The Splunk web interface is at https://myhost.com:8000

but when i requesting through URL its not coming. Can you please guide me where going wrong

Thanks

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...