https://community.splunk.com/t5/Getting-Data-In/How-to-encrypt-communication-between-a-universal-forwarder-and/m-p/131080#M26957 <P>I had a similar issue and found that I had an outputs.conf file in my etc/system/local directory that was being used instead of the outputs.conf in my app directory. I renamed the wrong outputs.conf file and restarted Splunk. You can tell if your outputs.conf file is being used as the sslPassword = testmy123 will be encrypted after it is read the first time. If you have an outputs.conf file in another directory being used first it may be that it is using a different port which is another indication that the wrong outputs.conf file is being used.</P> Sun, 31 May 2015 17:37:25 GMT m4him7 2015-05-31T17:37:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-encrypt-communication-between-a-universal-forwarder-and/m-p/131079#M26956 <P>I am not able to configure heavy forwarder inputs.conf file to receive encrypted traffic.</P> <P>1) config inputs.conf on heavy forwarder is given below. but <CODE>netstat -an</CODE> does not show heavy forwarder is listening on port 9998</P> <PRE><CODE>[splunktcp-ssl:9998] compressed = true [SSL] password = $1$YJqLPm4skNlFOQ== rootCA = /opt/splunk/etc/certs/ca.pem serverCert = /opt/splunk/etc/certs/splunk-dev.pem </CODE></PRE> <P>2) On universal forwarder I am using app with outputs.conf </P> <PRE><CODE>[tcpout] defaultGroup = splunkssl sendCookedData = true dnsResolutionInterval = 300 [tcpout:splunkssl] compressed = true server = heavy forwarder name :9998 sslCertPath = C:\Program Files\SplunkUniversalForwarder\etc\apps\FW_DEV_NA_Encrypt\default\certs\splunk-dev.pem sslPassword = testmy123 sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\apps\FW_DEV_NA_Encrypt\default\certs\ca.pem sslVerifyServerCert = false </CODE></PRE> Fri, 29 May 2015 19:27:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-encrypt-communication-between-a-universal-forwarder-and/m-p/131079#M26956 shaileshmali 2015-05-29T19:27:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-encrypt-communication-between-a-universal-forwarder-and/m-p/131080#M26957 <P>I had a similar issue and found that I had an outputs.conf file in my etc/system/local directory that was being used instead of the outputs.conf in my app directory. I renamed the wrong outputs.conf file and restarted Splunk. You can tell if your outputs.conf file is being used as the sslPassword = testmy123 will be encrypted after it is read the first time. If you have an outputs.conf file in another directory being used first it may be that it is using a different port which is another indication that the wrong outputs.conf file is being used.</P> Sun, 31 May 2015 17:37:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-encrypt-communication-between-a-universal-forwarder-and/m-p/131080#M26957 m4him7 2015-05-31T17:37:25Z