Hello Splunkers, We have ran into several issues primarily with getting data into Splunk over HTTP Collectors. It appears that we need to update our cert with one that has a root ca that has been applied to our Splunk instance instead of a self-signed certificate. We are trying to determine what impact updating the cert across our entire environment could have.  After adding a cert to splunk web does not push down the the HTTP collectors. They were still using the self-signed certificate. So it appears adding a new certificate to the cluster is required. This will be my first time updating the certificate across the entire environment so feel free to provide any advice or doc pages that could assist. Documentation we are currently using: https://docs.splunk.com/Documentation/Splunk/9.0.2/Security/ConfigureandinstallcertificatesforLogObserver ... View more

Hello fellow Splunkers,   One of our end users was attempting to investigate a Splunk Alert. When they attempted to access the URL contained in the email. They received a permissions denied error. They also received the same alert when manually navigating to the alert under the "Alerts" section and attempt to review the triggered alert. The alert permission are set so anybody can read the alert, but only Power Users and Admins are able to right.   I have reviewed a couple of other Splunk Community post regarding similar permission issues but was unable to locate a solution. Does anyone have an idea what could be causing this?   - Hutch ... View more

We are currently attempting to locate why a scheduled search cannot run. We were finally able to locate the search and the reason why. The search that cannot run is a default search that is apart of a default dashboard within the  License Monitor for Splunk application that is located on Splunk Base. The search is failing because a macro is either misspelled or does not exist, which in this case it appears that it does not exist.    The macro 'index_assignment_notable_management' does not exist. I was wondering if this macros is perhaps located within another app or if it is no longer contained within the app?   https://splunkbase.splunk.com/app/3521/ ... View more

Hey Everyone, We are currently running into an issue with one of our sourcetypes coming in roughly five hours in the future. We have reviewed the appliance and verified that the server is set to the correct time but we are unable to locate any issues on the appliance. We are attempting to modify inputs.conf and props.conf to manually adjust the time. We need the time to come in as central time. Example of timestamp in log     { "Timestamp": "7/1/2022 4:15:28 PM", "MessageTime": "7/1/2022 4:15:31 PM" ..........     UF local/inputs.conf     [monitor://D:\loglog\*.log] disabled=false followTail=0 index=logindex     UF local/props.conf     [source::....log] sourcetype=logsourcetype TZ=America/Chicago Time_PREFIX=Timestamp":       I have attempted to modify local/inputs.conf but reverted back to original one above.     [monitor://D:\loglog\*.log] disabled=false followTail=0 TZ=America/Chicago index=logindex     I have also review system/local to ensure that there is nothing in there as well. Any recommendations? We have been troubleshooting this timing issue for a few month now and I would like to finally find a way to resolve it on Splunk side as we appear to be unable to resolve it server side. ... View more