I need help with onboarding qualys cloud logs without using the Splunk Heavy Forwarder for API calls. I will like to know if there are ways to use lambda and other serverless approach, or a need to use Splunk Heavy Forwarder as a host detection system ... View more

Can some help with this error, i am getting with saml authentication setup for ADFS: ERROR Saml - No extra status code found in SamlResponse, Not a valid status. Could not evaluate xpath expression /samlp:Response/samlp:Status/samlp:StatusMessage or no matching nodes foundNo value found in SamlResponse for key=/samlp:Response/samlp:Status/samlp:StatusMessageCould not evaluate xpath expression /samlp:Response/samlp:Status/samlp:StatusDetail/Cause or no matching nodes foundNo value found in SamlResponse for key=/samlp:Response/samlp:Status/samlp:StatusDetail/Cause WARN SSLOptions - authentication.conf/[saml]/sslKeysfilePassword: deprecated; use 'sslPassword' instead WARN SSLOptions - authentication.conf/[saml]/sslKeysfile: deprecated; use 'clientCert' instead WARN UiAuth - Did not find a saml session index for this session, maybe a local user. IDP failed to authenticate request. Status Code="Responder" Check splunkd.log for more information about the failure. ... View more

I currently have 4 indexers. I have a new mount drive that I am trying to send Splunk cold data to. [volume:cold] coldpath = /mnt/splunk_cold Please can anyone explain how I can set this stanza in the cluster master (master app) for each individual indexers? Since the slave app has a higher precedence the system/local... ... View more

10-17-2018 03:54:47.137 +0000 WARN ConfReplication - downloadDeployableApps: Got zero-size baseline configuration 10-17-2018 03:54:47.137 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]} 10-17-2018 03:54:47.036 +0000 WARN ConfReplication - downloadDeployableApps: Waiting 100ms ... 10-17-2018 03:54:47.036 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]} 10-17-2018 03:54:46.935 +0000 WARN ConfReplication - downloadDeployableApps: Waiting 100ms ... 10-17-2018 03:54:46.935 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]} ... View more