John McGovern's Blog

GitHub - johnmcgovern/ansible-phantom-base: This Ansible role that installs or upgrades a bare Splunk Phantom instance.This Ansible role that installs or upgrades a bare Splunk Phantom instance. - GitHub - johnmcgovern/ansible-phantom-base: This Ansible role that installs or upgrades a bare Splunk Phantom instance.GitHubjohnmcgovern This is an Ansible

GitHub - johnmcgovern/ansible-splunk-base: This Ansible role that installs or upgrades a bare Splunk instance of a specified version with either systemd (Workload Management supported) or initd for process management.This Ansible role that installs or upgrades a bare Splunk instance of a specified version with either systemd (Workload Management

If your Deployment Server does not display a record for a particular Universal Forwarder, check the following: 1. Is the universal forwarder contacting the deployment server component on the intermediate forwarder? $SPLUNK_HOME/bin/splunk show deploy-poll If you need to reset the deployment server URI, run: $SPLUNK_HOME/bin/

HTTPS / TLS configuration on the Splunk HEC input port (default tcp/8088) differs slightly from the configuration of the web UI port (default tcp/8000) as the privKeyPath attribute is not available for configuration. Instead, the private key is appended the end of the file referenced in the serverCert attribute

The most straightforward/lowest risk encryption to configure and enable in the Splunk Environment is standard HTTPS (TLS) encryption to the Splunk Web GUI. I say that this is the lowest risk as any failure in implementation results only in a certificate error or webpage not loading and not an