All Apps and Add-ons

Streaming AWS data to Splunk using Firehose

segevgal87
Loves-to-Learn

Hi,

I'm trying to stream AWS logs using the Kinesis firehose method. I followed a tutorial and verified each step a few times.
I have generated a certificate for my Splunk Enterprise server using Let's Encrypt. My HEC is using that certificate and I know for sure that it is healthy and secure (used the following URL: https://host.domain.net:8088/services/collector/health)

I keep getting the following error on the monitoring of the Kinesis Firehose:

Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid.
Splunk.SSLHandshake

Any ideas about what could go wrong?

Splunk Version ............ 8.0.0

0 Karma
1 Solution

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

View solution in original post

0 Karma

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

0 Karma

amiracle
Splunk Employee
Splunk Employee

You need to have a valid certificate on either your Load Balancer (ELB for AWS deployments) or on your machine accepting the data from Firehose. The default HEC SSL Cert is not a valid third party SSL cert and will thus fail. You can either issue one from ACM (AWS Certificate Manager) so you can test your deployment. To make your life easier, you should use an ELB with a valid cert on a HF tier and then forward the data into your Splunk indexers. This link might help with how to set that up.

0 Karma

segevgal87
Loves-to-Learn

Hi,

I purchased a domain so I could try the ELB approach and it worked!
I guess the Let's Encrypt certificate was the issue...

Thanks amiracle and soumyasaha25

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...