topic Opencti addon on Splunk cluster in Getting Data In

Opencti addon on Splunk cluster

splunkreal — Thu, 09 Oct 2025 14:39:13 GMT

Hello, is Splunk opencti addon compatible on Splunk cluster (shc)?

From 2/3 search heads we are getting this error: "2025-10-09 16:22:56,618 ERROR pid=31312 tid=MainThread file=base_modinput.py:log_error:309 | Error in ListenStream loop, exit, reason: HTTPSConnectionPool(host='sXXX.XXX.XXX', port=8080): Max retries exceeded with url: /stream/4484559f-66f8-4107-9afc-1d9c141377fb?recover=2025-07-22T10:27:24Z (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1143)')))"

Even if we are not configured as SSL.

Thanks.

Re: Opencti addon on Splunk cluster

livehybrid — Thu, 09 Oct 2025 14:44:12 GMT

Hi @splunkreal

Can you confirm, are you expecting it to be http or https? The code for this app enforces SSL vertification if using https.

Can you also check the ta_opencti_add_on_settings.conf file in $SPLUNK_HOME/etc/<appDir>/local on the SH to confirm they are all the same and that its using the expected protocol?

You might also find this answer helpful:

https://community.splunk.com/t5/Getting-Data-In/Why-can-t-I-download-from-OpenCTI-Stream-Feed-into-Splunk/m-p/742780/highlight/true#M117993

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Opencti addon on Splunk cluster

splunkreal — Thu, 09 Oct 2025 14:46:42 GMT

Hi @livehybrid yes it's http, do you use it on SHC cluster? We are using v1.1.5 FYI