Is it Possible to Send Data to Splunk Without SSL Handshake?

rake — Thu, 31 Oct 2024 19:00:40 GMT

Hi,

I’m currently setting up a pipeline to send logs from AWS Kinesis Firehose to Splunk. I'm using Splunk’s Cloud Trial version as the destination endpoint, and my goal is to send data without requiring an SSL handshake.

Here's a summary of my setup:

Service: AWS Kinesis Firehose
Destination: Splunk Cloud Trail (using Splunk HEC URL)
Goal: Send data directly from Firehose to Splunk without SSL validation, if possible.
```
"errorCode": "Splunk.SSLHandshake",
"errorMessage": "Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid."
```
To troubleshoot, I also tested sending a record with the following command:
```
aws firehose put-record --delivery-stream-name FirehoseSplunkDeliveryStream \
--record='{"Data":"eyJldmVudCI6eyJrZXkxIjoidmFsdWUxIiwia2V5MiI6InZhbHVlMiJ9fQ=="}'
```
The SSL handshake error persists when connecting to the Splunk HEC endpoint.
Has anyone configured a similar setup, or is there a workaround to disable SSL validation for the Splunk endpoint? I'm new to splunk and just trying it out, any insights or suggestions would be greatly appreciated!
Thanks!

Re: Is it Possible to Send Data to Splunk Without SSL Handshake?

sainag_splunk — Thu, 31 Oct 2024 20:21:21 GMT

Hello @rake This could be the issue because you are on trial version (firehose has another endpoint) .

Deploying this add-on to free trial Splunk Cloud deployments is not supported at this time.

Refer: https://docs.splunk.com/Documentation/AddOns/released/Firehose/Installationoverview

Note: Disabling SSL validation is not recommended for production environments..

If this helps, please Upvote.

topic Is it Possible to Send Data to Splunk Without SSL Handshake? in Splunk Cloud Platform

Is it Possible to Send Data to Splunk Without SSL Handshake?

Re: Is it Possible to Send Data to Splunk Without SSL Handshake?