Limitations

General limitations

•HTTPS configuration: To be able to configure Splunk audit in HTTPS, the certificate used by Splunk for HTTP Event Collector (HEC) needs to be trusted by the TSS (for instance a certificate issued by the same CA as the TSS certificate).

•Audit track page in TSS Console do not list Splunk data: If TSS applications are configured to save TSS audits using Splunk, the Audit Track page will not list Splunk data.

•No fallback method to save the TSS audit data in case of Splunk misconfiguration: If TSS applications are configured to save TSS audits using Splunk but its configuration is incorrect, TSS audit data will not be saved elsewhere.

•Splunk version: Splunk Enterprise 6.3 and later or Splunk Cloud is required.