I've installed the Okta Identity Cloud Add-on for Splunk. There was an attempt to configure it a while ago but wasn't tested much. When looking at it again I noticed that there was a 401 Unauthorized error when trying to make the API request. I had the admin create a new token and I configured the token and input in the app. I don't see any errors in the logs, in the app log it does show the message "No logs returned". I know there were both failed and successful attempts to log in to that Okta. Is there anything else I can check on the Splunk or Okta side?         2021-04-02 14:44:05,498 INFO pid=7784 tid=MainThread file=splunk_rest_client.py:_request_handler:105 | Use HTTP connection pooling 2021-04-02 14:44:05,541 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: log_limit 2021-04-02 14:44:05,569 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: log_limit 2021-04-02 14:44:05,582 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_collectLogs sees an existing next link value of: https://[redacted].oktapreview.com/api/v1/logs, picking up from there 2021-04-02 14:44:05,602 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: max_log_batch 2021-04-02 14:44:05,602 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: skip_empty_pages 2021-04-02 14:44:05,602 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: http_request_timeout 2021-04-02 14:44:05,602 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: allow_proxy 2021-04-02 14:44:05,602 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: bypass_verify_ssl_certs 2021-04-02 14:44:05,603 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_getSetting is looking for values for: custom_ca_cert_bundle_path 2021-04-02 14:44:05,603 INFO pid=7784 tid=MainThread file=setup_util.py:log_info:117 | Customized key can not be found 2021-04-02 14:44:05,603 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | Use of the proxy has been enabled through explicit definition of allow_proxy 2021-04-02 14:44:05,603 INFO pid=7784 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2021-04-02 14:44:05,821 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_okta_caller n_val does not match our valid pattern with 0 results, store the current URL: https://[redacted].oktapreview.com/api/v1/logs 2021-04-02 14:44:05,822 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_okta_caller we will now stash n_val with: https://[redacted].oktapreview.com/api/v1/logs 2021-04-02 14:44:05,842 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=Zero logs returned         ... View more

I have a Splunk server which is receiving data on a tcp-ssl port successfully for a particular application (SecureCircle). I'm trying to set up a new port to receive data from Palo Alto firewalls but it's running into an the following error:       WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='certificate unknown'       I'm using the same certificate an SSL configuration for both ports so I know that the cert is fine. It's not a self singed cert. It's valid until 2022. I've been looking through some old posts with similar errors but none of them seemed to match my issue.  Below is my Port and SSL configuration from the btool inputs command       /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf [SSL] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf allowSslRenegotiation = true /opt/splunk/etc/system/default/inputs.conf cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 /opt/splunk/etc/system/default/inputs.conf ecdhCurves = prime256v1, secp384r1, secp521r1 /opt/splunk/etc/system/local/inputs.conf host = splunkhost.mydomain.com /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf requireClientCert = false /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf serverCert = /opt/splunk/etc/auth/splunkhost.mydomain.com/splunkhost.mydomain.com.pem /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf sslPassword = [Redacted] /opt/splunk/etc/system/default/inputs.conf sslQuietShutdown = false /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf sslVersions = tls1.2 /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf [tcp-ssl://6514] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf host = splunkhost.mydomain.com /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf index = pan_logs /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf sourcetype = pan:log       The configuration for the working port is:       /opt/splunk/etc/apps/ahs_ta_securecircle/local/inputs.conf [tcp-ssl://8443] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/local/inputs.conf host = splunkhost.mydomain.com /opt/splunk/etc/apps/ahs_ta_securecircle/local/inputs.conf index = dlp /opt/splunk/etc/apps/ahs_ta_securecircle/local/inputs.conf sourcetype = SecureCircle       ... View more