topic Re: SSL/TLS on a TCP data input? in Security

SSL/TLS on a TCP data input?

dholmes007 — Sun, 07 Jun 2020 17:53:03 GMT

I need to setup a TCP data input and I need to ensure that it is SSL/TLS.

I understand that I can add a stanza to an inputs.conf file as referenced in this post:
https://answers.splunk.com/answers/684045/how-to-enable-tcp-data-input-with-ssl.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev

My question is - which inputs.conf file? The data is coming in to my Search Head server and there are a bunch of apps installed there, each with their own inputs.conf file. Which one controls the TCP Data Inputs?

Thanks.

Re: SSL/TLS on a TCP data input?

richgalloway — Thu, 02 Apr 2020 19:05:49 GMT

Any app can contain inputs.conf and set TCP attributes. I recommend creating a custom app (org_tcpinputs) for the settings. Before restarting Splunk to apply the changes, run btool to verify the settings are as you expect. That's to avoid conflicts with another app.

Re: SSL/TLS on a TCP data input?

dholmes007 — Thu, 02 Apr 2020 19:23:27 GMT

Is there a default place where the TCP Input would look for its settings once I have created it?

Re: SSL/TLS on a TCP data input?

richgalloway — Thu, 02 Apr 2020 19:27:01 GMT

Splunk looks in all inputs.conf files and merges what it finds based on the precedence order described at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Wheretofindtheconfigurationfiles