I have configured below ssl versions in inputs, outputs and server.conf file on HF and IDX sslVersions = tls1.1, tls1.0, -tls1.2 But the below command on HF and IDX gives the output as TLS1.2 which I have restricted splunk to use for communication. ./splunk cmd python -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']"; From my observation, no matter which versions is configured, it simply shows TLS1.2 Given nmap command just shows the available ssl versions and ciphers. nmap -sV --script ssl-enum-ciphers -p 443 my.splunk.host If we configure multiple ssl versions, we wont be able to find which ssl versions is used in communication. ... View more

There is no way to identify which ssl version is used in SSL communication from splunk side. However, you can restrict splunk to use a specific ssl version by specifying the allowable ssl versions in inputs.conf and outputs.conf file. sslVersions = * Comma-separated list of SSL versions to support * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2" * The special version "*" selects all supported versions. The version "tls" selects all versions tls1.0 or newer * If a version is prefixed with "-" it is removed from the list * SSLv2 is always disabled; "-ssl2" is accepted in the version list but does nothing * When configured in FIPS mode ssl3 is always disabled regardless of this configuration * The default can vary. See the sslVersions setting in * $SPLUNK_HOME/etc/system/default/outputs.conf for the current default. Please refer the below link for more details: https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Outputsconf#TCPOUT_ATTRIBUTES---- https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/SetyourSSLversion ... View more

In the "thirdlane" app, all dashboard panels have searches queries starting like below index="thirdlane" sourcetype="asterisk_queue_log_$queue_log_type$" From the "thirdlane"app setting button we can either select the Asterisk CDR Source Type as "text file" or "database" I have configured Asterisk CDR Source Type as text and I see the message "successfully saved" and this configuration is updated in the backed.conf file in local directory. However, this configuration is not taken into effect while running the searches and all the panels shows "waiting on input". Resolution: I have fixed this issue by manually editing all the search queries and replacing the sourcetype="asterisk_queue_log_$queue_log_type$" as sourcetype="asterisk_queue_log_text and sourcetype="asterisk_cdr_$cdr_type$ as sourcetype="asterisk_cdr_text. ... View more

"_tzhint"needs to be removed. It is not a documented feature and it was only used in splunk STORM which was the precursor to Cloud. It is NOT supported. So it won't change the logs timestamp. Analyse your logs and set proper values for the below parameters in props.conf file. [web_logs] TIME_PREFIX = link text MAX_TIMESTAMP_LOOKAHEAD = link text TIME_FORMAT = link text TZ = UTC The above configuration should fix this issue. For more details, refer the below links: http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf#Timestamp_extraction_configuration http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Configurepositionaltimestampextraction ... View more

Your question is answered in the below post. https://answers.splunk.com/answers/302532/large-lookup-caused-the-bundle-replication-to-fail.html ... View more

I downvoted this post because ignoreolderthan = [s|m|h|d] * the monitor input will compare the modification time on files it encounters with the current time. if the time elapsed since the modification time is greater than this setting, it will be placed on the ignore list. * files placed on the ignore list will not be checked again for any reason until the splunk software restarts, or the file monitoring subsystem is reconfigured. this is true even if the file becomes newer again at a later time. * reconfigurations occur when changes are made to monitor or batch inputs via the ui or command line. Refer the below link: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf#Valid_input_types_follow.2C_along_with_their_input-specific_settings: ... View more

Root cause: In pdfgen_chart.py we have a hard-coded value (600) for the width of chart and that is why labels are hidden in pdf. class Chart(SvgBasedViz):     def init(self, data, fields, props, locale, runningAsScript=False):         SvgBasedViz.init(self, data, fields, props, width=600, height=350, genSvgScriptName="gensvg.js", runningAsScript=runningAsScript, locale=locale) This truncates the labels if the chart width is exceeded. Workarounds: Go to the dashboard: a. Export> Print> Destination> Save as PDF Or Use the browsers 'Print' as 'Save as PDF' option. b. You can increase the width value from 600 to a value that suits your requirement. I suggest you to try 1000. The pdfgen_chart.py script is in the following path "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\ pdfgen_chart.py Post changes restart the search head(This is where you need to change this value). Note: 1. Increasing this value will change the visualizations of other Pdf's. 2. You need to take backup of this script in case if you are going to upgrade the splunk. Reason: While up gradation this script will be replaced. 3. You can do the modifications at your own risk. ... View more