Hello Everyone,  I'm in a bit of a brain pickle right now and hoping the community can help. I have a Linux box with a UF on it. Currently it is setup to send to a HF with SSL configured on the port. I'm now in a situation where I need to allow that same UF to send to a different HF with a different SSL Cert.  I thought this wouldn't be an issue, I know how to go into outputs.conf and specify two different outputs variables and I even know on my inputs.conf file I can specify to monitor the same file to 2 different indexers with different indexes.  What I don't know is how this all works in the server.conf file. On both HF/Indexers I have a server.conf file setup, how do I get this to work on the UF? Is there a way for me to specify 2 different HF/Indexers SSL configs in server.conf like you can with outputs.conf? Any help would be appreciated! ... View more

Hey Guys, We are in a Splunk Cloud environment with ES, and we have added our own TAXII feed as well as some open source TAXII feeds and we can see that they start "polling" but we never see them download any collection sets or fail in the event logs so it doesn't appear to be working. Has anyone else configured this in Splunk Cloud and if so do you know if there is something else we need to enable for our TAXII feeds to work? Thanks! ... View more

Hey All, I'm setting up SAML authentication in our new Splunk Cloud environment and everything appears to be working with our on-prem home grown identity provider as I'm getting to our authentication source and logging in successfully. However after I do I get presented with the Splunk Cloud terms of service page and appear to get stuck in a loop when I press "Accept" and "Ok", it just takes me back to the same page. Has anyone run into this with Splunk Cloud and if so how have you been able to fix it? Thanks! ... View more