topic Re: How to fix "ERROR TcpInputConfig - SSL context not found" when using inputs.conf [tcp-ssl://6514]? in Getting Data In

How to fix "ERROR TcpInputConfig - SSL context not found" when using inputs.conf [tcp-ssl://6514]?

simpkins1958 — Thu, 21 Jan 2016 20:54:07 GMT

Getting error: "TcpInputConfig - SSL context not found" when inputs.conf in etc/system/local has:

[tcp-ssl://6514]
connection_host = dns
sourcetype = syslog
disabled=0

What must be done to fix this error?

simpkins1958 — Tue, 29 Sep 2020 08:30:00 GMT

Needed to add the SSL stanza to inputs.conf. Now sending syslog data to splunk over TLS/SSL.

[tcp-ssl://6514]
connection_host = dns
sourcetype = syslog
disabled = 0

[SSL]
rootCA = $SPLUNK_HOME/etc/auth/cacert.pem
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = $1$B3HE+YB7UQbp

simpkins1958 — Thu, 21 Jan 2016 23:04:00 GMT

This blog was helpful in figuring out how to use Splunk certs for syslog over TCP-SSL.

jworthington_sp — Fri, 22 Jan 2016 02:39:13 GMT

jbuckner85 — Thu, 20 Oct 2022 20:56:10 GMT

Thanks, this fixed my problem when updating my inputs.conf. I was also missing the SSL stanza.