About dmesler

dmesler · ‎09-20-2012

Interesting, so my tiered approach of having separate subdirectories for searchheads, indexers, and forwarders is what's preventing my deployment server from automatically rereading the contents of ../deployment-apps? I've been having to run 'splunk reload deploy-server' or 'splunk refresh deploy-clients' (either works) to get the apps to deploy and wondered why the docs made no mention of having to do this. Seems like this is a bug that needs squashing, have you submitted a bug report? Since running 'splunk reload deploy-server' requires authentication this has made automation impossible. (Ok, not impossible, but it would mean having to put a username/password in a config or script somewhere, blech.)

dmesler · ‎04-25-2011

I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added [monitor:///new/file] _TCP_ROUTING=testGroup to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?

dmesler · ‎04-12-2011

Hello, I'm trying to configure splunk to use certs created against a new self-signed ca cert. (Ala http://answers.splunk.com/questions/7164/how-do-i-set-up-ssl-forwarding-with-new-self-signed-certificates-and-authenticat) Everything seemed to be going well until I enabled "requireClientCert" in server.conf. Now the splunk web process (port 8000) is no longer able to talk to the management port (8089). I get a 503 error and "The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running." I used the createssl command to create a new server cert as well as new web certs against the new new ca. Any help?

dmesler · ‎12-08-2010

I have SSO working with apache responding to a "splunk" cname. But when splunk emails search results the URL is https://hostname:port/... How can I configure splunk to just use a "https://splunk" url so connections will pass through apache?

dmesler · ‎07-26-2010

Upgrading mod_auth_kerb wasn't an option. Fortunately I had success adding this: RequestHeader edit REMOTE_USER "@REALM$" "" Thanks though.

dmesler · ‎07-23-2010

I'm trying to enable SSO by proxying from Apache w/ mod_auth_kerb. The problems seems to be the contents of Remote-User include the @REALM. Is there some way to strip the realm from Remote-User in Apache or configure Splunk to ignore it?

Posts	7
Solutions	1
Karma Given	5
Karma Received	8
Member Since	‎07-23-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

_TCP_ROUTING not exclusive?

requireClientCert kills communication between splu...

Configure URL in saved search results

Splunk SSO with mod_auth_kerb

Re: Three tier deployment topology not working rig...

_TCP_ROUTING not exclusive?

requireClientCert kills communication between splu...

Configure URL in saved search results

Re: Splunk SSO with mod_auth_kerb

Splunk SSO with mod_auth_kerb