Hi jadengoho. Can you please explain what configuration was added/extended in limits.conf to resolve this? Thanks ... View more

Hello, Just wondering if anyone found the fix for 14.2 RU2 and 14.2 RU2 MP1 ? Thanks in advance ... View more

the above dint work for me. This is what works in our environment props.conf [sourcetypeName] TRANSFORMS-ignoreCommentedLines = ignoreLinesWithHash [ignoreLinesWithHash] REGEX = ^(?:[#].*) DEST_KEY = queue FORMAT = nullQueue ... View more

What works for us. We have a SHD cluster and authentication is provided by ADFS SSO. For every query, add quotes around action=log* .. For some reason, splunk is NOT detecting action = login attempt as a key-value pair ... may be because there is a space ? ... Example: index=_audit sourcetype=audit user=* "action=log*" The above works! ... View more

@sylbaea - I am strugging with setting up Splunk SHC to work with ADFS (all internal) ... any chance you can share any info? I have a F5 LB VIP (no SSL) - call this https://splunk:443 that points to 3 SHC members (call this https://splunk1:8000 , https://splunk2:8000, https://splunk3:8000) Each of the splunk cluster members - have the same "ssl certificate" with CN = splunk (Custom CA signed cert) I am struggling to follow steps on https://docs.splunk.com/Documentation/Splunk/7.2.4/Security/SAMLSHC ..... Any help would be great! ... View more