All Apps and Add-ons

Streaming AWS data to Splunk using Firehose

segevgal87
Loves-to-Learn

Hi,

I'm trying to stream AWS logs using the Kinesis firehose method. I followed a tutorial and verified each step a few times.
I have generated a certificate for my Splunk Enterprise server using Let's Encrypt. My HEC is using that certificate and I know for sure that it is healthy and secure (used the following URL: https://host.domain.net:8088/services/collector/health)

I keep getting the following error on the monitoring of the Kinesis Firehose:

Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid.
Splunk.SSLHandshake

Any ideas about what could go wrong?

Splunk Version ............ 8.0.0

0 Karma
1 Solution

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

View solution in original post

0 Karma

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

0 Karma

amiracle
Splunk Employee
Splunk Employee

You need to have a valid certificate on either your Load Balancer (ELB for AWS deployments) or on your machine accepting the data from Firehose. The default HEC SSL Cert is not a valid third party SSL cert and will thus fail. You can either issue one from ACM (AWS Certificate Manager) so you can test your deployment. To make your life easier, you should use an ELB with a valid cert on a HF tier and then forward the data into your Splunk indexers. This link might help with how to set that up.

0 Karma

segevgal87
Loves-to-Learn

Hi,

I purchased a domain so I could try the ELB approach and it worked!
I guess the Let's Encrypt certificate was the issue...

Thanks amiracle and soumyasaha25

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...