HTTP Event Collector SSL problem

DMohn — Tue, 11 Jun 2019 09:23:55 GMT

Hi all,

I am trying to send events to HEC locally via CLI and keep getting a SSL error. I have looked up several docs, but I have not yet found the solution to it. My problem is like this:

Command:
curl -vvv -k -H "Authorization: Splunk my-hec-token" https://mysplunkhost:8088/services/collector/event -d '{ [aWholeLotOfJSONformattedData] }'

Return is:

* Hostname was NOT found in DNS cache
*   Trying xx.xx.xx.xx...
* Connected to mysplunkhost (xx.xx.xx.xx) port 8088 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs/
* SSLv3, TLS unknown, Certificate Status (22):
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Any advise on where I can fix this?

Re: HTTP Event Collector SSL problem

DMohn — Tue, 11 Jun 2019 12:57:49 GMT

Found the solution by myself, after a while.

If you don't enable SSL in the http input setting, Splunk won't accept https calls 🙂

So be aware of that!

topic Re: HTTP Event Collector SSL problem in Security

HTTP Event Collector SSL problem

Re: HTTP Event Collector SSL problem