Please see http://answers.splunk.com/answers/188784/after-update-to-splunk-enterprise-62-why-does-the.html for the answer. To Summarize: It is a product defect, I believe for the deployment monitor. Cause: In Splunk Enterprise 6.2, indexers are logging new events to metrics.log/group=tcpin_connections to record forwarder connection events, such as a connection closing. Fix is to change macros.conf in deployment monitor. Details are here ... View more

I would like to see that documentation updated. When I attempt to use Splunks openssl to create a cert the following error occurs: openssl: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory This problem was asked in http://answers.splunk.com/answers/32462/creating-new-csr-unable-to-find-shared-library-libsslso098 and there are no answers. Any help would be appreciated. ... View more