Appian Integration

pavankumarh — Mon, 15 Nov 2021 18:23:01 GMT

Hi All, We are working on getting Appian data to splunk. Appian has been configured to push the logs to splunk syslog endpoint. We have tried several things but the data received in splunk is still encrypted.

https://docs.appian.com/suite/help/21.2/Log_Streaming_for_Appian_Cloud.html#prerequisite-checklist

Below is the config of splunk. Please help us if you have done this is past or have knowledge on how to fix this.

Splunk Version : 8.1.4

etc\apps\search\local\inputs.conf

[tcp://514]
connection_host = ip
index = appian
sourcetype = syslog

[SSL]
requireClientCert = false
serverCert = $SPLUNK_HOME\etc\auth\splunkweb\myDataCertificate.pem
sslVersions = tls1.2
cipherSuite = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:ADH-AES256-GCM-SHA384:ADH-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256

Note : myDataCertificate.pem is a combination of server+interimCA+rootCA.

Sample Encrypted Data

10/10/21 8:04:18.000 PM
\x00\x00\x00\x9E\x00\x9F\xC0|\xC0}\x003\x00g\x009\x00k\x00E\x00\xBE\x00\x88\x00\xC4\x00\x00\xA2\x00\xA3\xC0\x80\xC0\x81\x002\x00@\x008\x00j\x00D\x00\xBD\x00\x87\x00\xC3\x00\x00f\x00\x00D\x00\x00\x00\x00\x00\x00\xFF\x00\x00\x00#\x00\x00\x00

10/10/21 8:04:18.000 PM
\xC0r\xC0\xC0\xC0/\xC00\xC0\x8A\xC0\x8B\xC0\xC0'\xC0\xC0v\xC0\xC0\x00\x9C\x00\x9D\xC0z\xC0{\x00/\x00<\x005\x00=\x00A\x00\xBA\x00\x84\x00\xC0\x00

Re: Appian Integration

yackle_official — Thu, 29 Jun 2023 17:39:59 GMT

Did you ever find a solution to this issue?

topic Re: Appian Integration in Getting Data In

Appian Integration

Re: Appian Integration