Splunkers, anyone got this data onboarded  to Splunk? If so, would you mind to share feedback or docs.   ... View more

splunk ALL=(root) NOPASSWD: /usr/bin/systemctl restart Splunkd.service splunk ALL=(root) NOPASSWD: /usr/bin/systemctl stop Splunkd.service splunk ALL=(root) NOPASSWD: /usr/bin/systemctl start Splunkd.service splunk ALL=(root) NOPASSWD: /usr/bin/systemctl status Splunkd.service splunk ALL=(root) NOPASSWD: /usr/bin/systemctl restart Splunkd splunk ALL=(root) NOPASSWD: /usr/bin/systemctl stop Splunkd splunk ALL=(root) NOPASSWD: /usr/bin/systemctl start Splunkd splunk ALL=(root) NOPASSWD: /usr/bin/systemctl status Splunkd splunk ALL=(root) NOPASSWD: /opt/splunk/bin/splunk restart splunk ALL=(root) NOPASSWD: /opt/splunk/bin/splunk stop splunk ALL=(root) NOPASSWD: /opt/splunk/bin/splunk start splunk ALL=(root) NOPASSWD: /opt/splunk/bin/splunk status   sudo systemctl daemon-reload   This works just fine!   ... View more

This works, thanks! ... View more

Hi Splunkers, I was getting almost the same issue when I was trying to start my Splunk Search Head: error:00000000:lib(0):func(0):reason(0) AES-GCM Decryption failed! Decryption operation failed: AES-GCM Decryption failed! And I was able to fix it, by the following: 1) I have commented out the pass4SymmKey in /opt/splunk/etc/system/local/server.conf [general] pass4SymmKey = $........ 2) I have changed the sslPassword to the Splunk default password: sslPassword = password 3) After restart the server, the issue was no longer shown and Splunk automatically creates a new pass4SymmKey value. Hope it works for anyone who needs to fix this issue! ... View more

Hi @LordSnooz For this purpose, I going to use the Splunk _json sourcetype default settings (It works in my case) My sourcetype name for this example will be "test" A workaround to do this would be the following: 1) Create a custom sourcetype 2) Configure your custom sourcetype (in opt/splunk/etc/system/local/props.conf) as: [ test ] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=AUTO INDEXED_EXTRACTIONS=json KV_MODE=none category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true EVAL-my_tag = tag 3) Configure your data input (Using the sourcetype created, [ test ] in my case ) 4) Search your results index=< your_index_name > sourcetype=test my_tag="7b91119dbad4" Please try and let me know if it is working for you or not. ... View more