@saimasai the username should be provided in the email to you after you sign up. Did that combination not work? ... View more

@Yurii_K unfortunately I'm not sure how much I can help here. A sales representative should be reaching out about the Trial and you can work with them, or you can call our Support lines below for some assistance from our Customer Service group. Customer Support is a paid service, but we want you to have a great experience with Splunk, so we will do what we can to assist. https://www.splunk.com/en_us/about-splunk/contact-us.html#tabs/tab_parsys_tabs_CustomerSupport_4 ... View more

@Yurii_K , If you have used a Splunk Trial before, I'd recommend clearing cache (I have this issue with my personal instance every once in a while) and trying again, trying a non-cached browser session, or trying another browser to log into that new trial instance. Let me know how you go, Brenden ... View more

@TanmoyNandy , There is now a Forgot Password function in the GUI for you all to have an automated way to get through this. It has been tested and confirmed to work. Have you tried this process on the trials? ... View more

I've spoken to our Support Department, and if you call into our Support Line, they now have a process to work through a password reset with you. We're working on adding a self-password-reset to Trials for this issue in the future. ... View more

G'day @panjoyce , The original problem was an infrastructure-wide issue that has been resolved. Were you able to log in before? Since you posted this, have you been able to log in again? My apologies for the delay. -Brenden ... View more

@gcoffeycs, Brenden here, Manager for the Splunk>Cloud Network Operations Center in AMER. I'm sorry to hear you ran into some issues with your trial instance. In an attempt to make the automation and experience around the trials better, and provide you with a trial on the latest platforms and technologies we've put into Splunk>Cloud, we missed a trial-configuration piece that caused this. We have now remediated the service and you should be able to use the service as intended. If you still cannot log in, we have confirmed that new instances have the fix in place, so you can sign up with another email address and should be all good to go. If you have trouble doing this, feel free to reply and I'll get you taken care of. With regard to the lack of Support on Trials, we are exploring options for this, and are aware of your discussion with the account team. I will follow up with them to make that experience better as well. Please let me know if you have any further questions. ... View more

Also I did an Real Time 1min window and sent backfill data. Nothing showed. ... View more

Even before any of this ^ wouldn't it show in the HEC Metrics that something is actually hitting? ... View more

So the field in the app asks for the Splunk URL. Not the HEC endpoint. Since I use reverse proxy for the UI, I tried that. But I've also tried just putting the beginning bit of the HEC endpoint, assuming that it would add the /services/collector/event bit. When I put in the base URL (without the reverse proxy stuff) it says successful, but my DMC shows nothing, and there's no data 😞 ... View more

any more thoughts @nickhillscpl ? ... View more

I've tried the following (both http and https, with enabling and disabling SSL respectively in the HEC config): internal IP while on the same wifi network with reverse proxy configuration removed. external url which goes through nginx reverse proxy with both 8088 and 443 as ports The one thing I haven't done is reconfigure my port forwarding and reverse proxy config so that my external URL points directly at my Splunk instance. ... View more

I tested this with my reverse proxy config removed, local IPs, on the same local network as the instance last night, with the same result 😞 ... View more

@ddrillic reloading auth would not have an effect on auth not working. Splunk will go through whichever LDAP Strategies you have configured. Depending on the core of your LDAP, you might try cloning to a second one and adding a second strategy to hit that server when your primary is having issues. But you were right, this VERY likely won't be Splunk, as Splunk will attempt to connect to the LDAP server each time the user tries to log in to make sure that they're still supposed to have access. ... View more

Yes @sarah115. You'd have to submit a ticket to Splunk Cloud Support to have this done. Reassign Knowledge Objects http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Resolveorphanedsearches#Use_the_Reassign_Knowledge_Objects_page_in_Settings Compile a list of users you want to have removed, and submit them in a support ticket with a link to think answers post for clarity on what you want done. 🙂 Enjoy your weekend. ... View more

@sidhantbhayana if you remove them from the SAML IdP, they will no longer have access. Authentication.conf is what gets applied after they are approved by the IdP. ... View more

Here's a docs article on that exact topic: https://docs.splunk.com/Documentation/Splunk/6.6.3/Security/BestpracticeforremovinganLDAPuser ... View more

Done. Please upvote for exposure. 🙂 (yay fake internet points!) ... View more

This would be good to confirm that it is returning the group we think it is (group1) so that we're sure it SHOULD be applying that role to user1. ... View more

Based on the configuration, as long as user1 is a member of group1, they should receive those permissions as well as their userToRoleMap permissions. ... View more

I do not believe that this limitation exists. What version are you running? ... View more

I downvoted this post because this is not a helpful story to the community. it did not actually answer any questions. ... View more